โ† Back to Skills Marketplace
melody1015

Forge ๐Ÿ”จ Repair-Inspect Loop

by melody1015 ยท GitHub โ†— ยท v1.0.0
cross-platform โš  suspicious
409
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install forge-loop
Description
Forge ๐Ÿ”จ โ€” Repair-Inspect loop orchestrator. Automated code repair with independent inspection, dependency-aware parallel execution, protected file guardrail...
README (SKILL.md)

Forge ๐Ÿ”จ โ€” ็ปดไฟฎ-็›‘็†่‡ชๅŠจๅพช็Žฏ

Automated repair-inspect loop with state persistence, dependency analysis, and safety guardrails.

When to Use

  • Multiple repair tasks from review board / audit / user instructions
  • Need independent verification (not just "looks fixed")
  • Want protected file safety + auto-commit on PASS

Quick Start

cd /path/to/project

# 1. Initialize
python3 ~/clawd/skills/forge/scripts/forge.py init

# 2. Add tasks
python3 forge.py add "ไฟฎๅค็ฉบๅ€ผๅค„็†" --criteria "็ฉบ่พ“ๅ…ฅไธๅดฉๆบƒ" --priority P0
python3 forge.py add "ๆธ…็†ๅบŸๅผƒไปฃ็ " --criteria "ๆ— importๆŠฅ้”™" --depends task-001

# 3. See execution plan
python3 forge.py plan

# 4. Run (outputs spawn instructions)
python3 forge.py run

# 5. Execute spawns, then run again to check results
python3 forge.py run   # checks results, auto-loops on FAIL

# 6. When all done
python3 forge.py summary

CLI Reference

Command Description
init --workdir DIR Initialize forge session
add "desc" --criteria "..." --depends task-001 --priority P0 Add repair task
plan Show dependency graph + parallel execution waves
run Advance state machine (spawn or check results)
status Show current progress
check Pre-commit safety check (protected files, deletions)
summary Generate completion report
reset Clear state

How It Works

State Machine (per task)

pending โ†’ repairing โ†’ inspecting โ†’ done
                โ†‘          โ”‚
                โ””โ”€โ”€ fail โ”€โ”€โ”˜   (auto-loop, max 5 rounds)

inspecting โ†’ needs_human  (pause, escalate)
inspecting โ†’ escalated    (>5 rounds)
repairing  โ†’ needs_human  (all BLOCKED)

Dependency-Aware Parallel Execution

Tasks without dependencies run in parallel. forge.py plan shows execution waves:

Wave 1: task-001, task-002, task-003  (ๅนถ่กŒ)
Wave 2: task-004 โ† task-001          (็ญ‰task-001ๅฎŒๆˆ)

Safety Guardrails (3 layers)

  1. Protected files โ€” protected-files.txt in project root. Listed files cannot be modified by repair agents. Touching them โ†’ BLOCKED โ†’ NEEDS_HUMAN.
  2. Pre-commit diff check โ€” forge.py check detects: file deletions, protected file modifications, abnormally large changes.
  3. Prompt constraints โ€” Repair engineer prompt explicitly forbids deletions, protected files, cron changes.

Experience Accumulation

Each repair produces a repair_pattern with error classification and reusable solution templates. These are stored in forge-reflections.jsonl and the most recent 5 patterns are injected into future repair tasks as context.

Integration with AI Agents

When the agent receives repair tasks (from code review, audit, or user):

# 1. Init forge in project dir
exec("cd /path/to/project && python3 ~/clawd/skills/forge/scripts/forge.py init")

# 2. Add tasks
exec("python3 forge.py add 'Fix null handling in processor' --criteria 'No crash on empty input' --priority P0")

# 3. Run to get spawn instructions
exec("python3 forge.py run")
# โ†’ Script outputs spawn instructions

# 4. Execute spawns
sessions_spawn(task=read(task_file), label=label, model=model)

# 5. After spawn completes, run again
exec("python3 forge.py run")
# โ†’ Checks repair result โ†’ prepares inspector spawn
# โ†’ Or auto-loops on FAIL โ†’ prepares next repair spawn

# 6. On all PASS โ†’ git commit + notify

File Layout

forge/
โ”œโ”€โ”€ SKILL.md                           # This file
โ”œโ”€โ”€ scripts/
โ”‚   โ””โ”€โ”€ forge.py                       # Core orchestrator
โ”œโ”€โ”€ references/
โ”‚   โ””โ”€โ”€ protocol.md                    # Full protocol documentation
โ””โ”€โ”€ assets/
    โ””โ”€โ”€ templates/
        โ”œโ”€โ”€ repair-engineer.md         # Repair agent role reference
        โ””โ”€โ”€ inspector.md              # Inspector role reference

Project-side files (created by forge)

project/
โ”œโ”€โ”€ forge-state.json                   # State persistence (crash recovery)
โ”œโ”€โ”€ forge-reflections.jsonl            # Project-specific experience (stays with project)
โ”œโ”€โ”€ forge-output/                      # Task files and results
โ”‚   โ”œโ”€โ”€ task-001-repair-r1.task.md     # Repair spawn task
โ”‚   โ”œโ”€โ”€ task-001-repair-r1.json        # Repair result
โ”‚   โ”œโ”€โ”€ task-001-inspect-r1.task.md    # Inspect spawn task
โ”‚   โ””โ”€โ”€ task-001-inspect-r1.json       # Inspect result
โ””โ”€โ”€ protected-files.txt                # (optional) Protected file list

Experience: Two-Layer Architecture

forge/reflections/patterns.jsonl       # Universal patterns (cross-project, stays with skill)
project/forge-reflections.jsonl        # Project-specific patterns (stays with project)
  • Universal layer (forge/reflections/patterns.jsonl): Abstract lessons stripped of file paths and project context. Auto-extracted from project patterns after each repair. Deduped by pattern_name. Injected into ALL future repairs across any project.
  • Project layer ({project}/forge-reflections.jsonl): Full detail with file names, paths, project-specific context. Only injected when working on that project.
  • Auto-extraction: After each repair, extract_universal_pattern() checks if the pattern is generalizable (not too many project-specific paths). If so, it's added to the universal layer with dedup.

Doc-Sync Check (ๆ–‡ๆกฃๅŒๆญฅๆฃ€ๆŸฅ)

Forgeๆ”ถๅฐพๆ—ถ่‡ชๅŠจๆฃ€ๆŸฅ๏ผšไฟฎๆ”น็š„ไปฃ็ ๆ–‡ไปถๆ˜ฏๅฆๆœ‰ๅ…ณ่”ๆ–‡ๆกฃ้œ€่ฆๅŒๆญฅๆ›ดๆ–ฐใ€‚

ๅทฅไฝœๅŽŸ็†

  1. ไผ˜ๅ…ˆ่ฟ่กŒ scripts/tools/doc-sync-checker.py --json๏ผˆๅฆ‚ๆžœๅญ˜ๅœจ๏ผ‰
  2. ๅ›ž้€€ๅˆฐ references/doc-sync-manifest.yaml๏ผšไบคๅ‰ๅฏนๆฏ”forgeไฟฎๆ”น็š„ๆ–‡ไปถไธŽmanifestไธญ็š„authorityโ†’consumerๆ˜ ๅฐ„

้กน็›ฎ้…็ฝฎ

ๅœจ้กน็›ฎไธญๅˆ›ๅปบ references/doc-sync-manifest.yaml๏ผš

facts:
  api_config:
    authority: src/config.py
    consumers:
      - docs/api-reference.md
      - docs/deployment-guide.md
    last_synced: 2026-03-01

ForgeๅฎŒๆˆๆŠฅๅ‘Šไผšๆ˜พ็คบ๏ผš

๐Ÿ“„ ๆ–‡ๆกฃๅŒๆญฅๆฃ€ๆŸฅ โ€” 2 ไธชๆ–‡ๆกฃๅฏ่ƒฝ้œ€่ฆๆ›ดๆ–ฐ:
  โš ๏ธ docs/api-reference.md ๅฏ่ƒฝ้œ€่ฆๅŒๆญฅๆ›ดๆ–ฐ๏ผˆapi_config ็š„ๆƒๅจๆบ src/config.py ๅทฒไฟฎๆ”น๏ผ‰

Configuration

Via init flags or forge-state.json config section:

Key Default Description
model anthropic/claude-opus-4-6 LLM model for agents
max_rounds 5 Max repair-inspect cycles before escalation
repair_timeout 600 Repair agent timeout (seconds)
inspect_timeout 300 Inspector timeout (seconds)
auto_commit true Auto git-commit on PASS
Usage Guidance
This skill appears to implement the advertised repairโ†’inspect orchestration, but take these precautions before installing or running it on real repositories: 1. Audit scripts/forge.py (search for subprocess.run/exec/git calls and any network operations). Confirm exactly how commits and external commands are executed. 2. Disable auto-commit and automatic auto-looping during initial evaluation (set config.auto_commit = False and run single-step manual flows). Require human approval before any git push or commit to protected branches. 3. Review how 'universal' patterns are extracted and stored (forge/reflections/patterns.jsonl). If you will run this across multiple projects, either turn off universal extraction or ensure a strict sanitization step to remove any project-specific paths, sample data, or secrets. 4. Treat the doc-sync step as untrusted code execution: it will run project-provided scripts (e.g., scripts/tools/doc-sync-checker.py) if present. Only enable that in isolated/test environments or after reviewing those scripts. 5. Populate protected-files.txt for anything that must never be touched (credentials, deployment scripts, CI config). Test the protected-files enforcement on a sandbox repo with safe dummy files. 6. Run the skill first in a disposable clone/branch with no secrets, and inspect forge-output and reflections files to ensure no sensitive data is being recorded or leaked across projects. If you want, provide the full forge.py content (or search results for subprocess/git/network usage) and I can point to the exact lines to review and suggest safer configuration changes.
Capability Analysis
Type: OpenClaw Skill Name: forge-loop Version: 1.0.0 The skill is classified as suspicious due to a critical Remote Code Execution (RCE) vulnerability found in `scripts/forge.py`. The `check_doc_sync` function dynamically executes `scripts/tools/doc-sync-checker.py` if it exists within the project's work directory. This allows a malicious project owner to place arbitrary code in this file, which would then be executed by the OpenClaw agent running the Forge skill. While the skill's prompts for sub-agents include safety guardrails, this direct execution of untrusted project-supplied code constitutes a significant vulnerability, enabling potential self-exploitation of the agent.
Capability Assessment
โœ“ Purpose & Capability
Name/description match what is present: an orchestrator for repairโ†’inspect loops. The artifact contains an orchestrator script (scripts/forge.py), role templates, protocol docs, and state/reflection file conventions. It does not request unrelated credentials or binaries.
โš  Instruction Scope
The SKILL.md directs the agent to run forge.py to create tasks, spawn repair/inspect sessions, write outputs into the project (forge-output/), and automatically extract and reuse repair patterns. It also will try to run project-side helpers (e.g., scripts/tools/doc-sync-checker.py) if present. Two concerns: (1) the universal 'patterns.jsonl' is reused across all projects โ€” project-specific information may be insufficiently sanitized and could be injected into later repairs on other projects; (2) the doc-sync step and other scripted steps execute project-provided code, which can run arbitrary code in the project environment. Both are outside the minimal scope of โ€œorchestrationโ€ and increase risk.
โœ“ Install Mechanism
There is no external install spec โ€” this is instruction + bundled script. No network downloads or remote installers are involved in the skill bundle itself, which reduces supply-chain risk.
โ„น Credentials
The skill does not request environment variables or credentials. However it persistently stores two cross-cutting artifacts: a universal reflections file inside the skill (forge/reflections/patterns.jsonl) and project-specific reflections (project/forge-reflections.jsonl). If the extraction/sanitization heuristics fail, sensitive project data (paths, examples, tokens, or config snippets) could be recorded and then exposed to other projects' runs.
โš  Persistence & Privilege
The orchestrator will modify project state (forge-state.json, forge-output/, forge-reflections.jsonl) and โ€” per the protocol โ€” auto-commit changes on PASS (config.auto_commit = True by default). Combined with automatic retry loops ('auto-loop on FAIL' and up to 5 rounds) and cross-project universal pattern accumulation, the skill has a persistent and far-reaching footprint. While not flagged as always:true, the skill still performs high-privilege actions (writing, committing, executing project scripts) without human review by default.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install forge-loop
  3. After installation, invoke the skill by name or use /forge-loop
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release: Repair-Inspect loop orchestrator with dependency-aware parallel execution, protected file guardrails, two-layer experience accumulation, doc-sync checking, and crash-recoverable state.
Metadata
Slug forge-loop
Version 1.0.0
License โ€”
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is Forge ๐Ÿ”จ Repair-Inspect Loop?

Forge ๐Ÿ”จ โ€” Repair-Inspect loop orchestrator. Automated code repair with independent inspection, dependency-aware parallel execution, protected file guardrail... It is an AI Agent Skill for Claude Code / OpenClaw, with 409 downloads so far.

How do I install Forge ๐Ÿ”จ Repair-Inspect Loop?

Run "/install forge-loop" in the OpenClaw or Claude Code chat to install it in one step โ€” no extra setup required.

Is Forge ๐Ÿ”จ Repair-Inspect Loop free?

Yes, Forge ๐Ÿ”จ Repair-Inspect Loop is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Forge ๐Ÿ”จ Repair-Inspect Loop support?

Forge ๐Ÿ”จ Repair-Inspect Loop is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Forge ๐Ÿ”จ Repair-Inspect Loop?

It is built and maintained by melody1015 (@melody1015); the current version is v1.0.0.

๐Ÿ’ฌ Comments