curl -fsSL https://raw.githubusercontent.com/forgeinai/forgein/main/install.sh | bash

/forgein auth                    Authenticate CLI with your forgein account

/forgein mem                     List all memories (default)
/forgein mem list                List memories grouped by type
/forgein mem search <query>      Search memory bodies
/forgein mem add <type> <text>   Add a new memory
/forgein mem prune               Remove stale memories interactively
/forgein mem audit               Check index for structural issues
/forgein mem sync                Sync memory files with forgein cloud

/forgein export cursor           Write context to .cursorrules
/forgein export windsurf         Write context to .windsurfrules
/forgein export copilot          Write context to .github/copilot-instructions.md
/forgein export chatgpt          Format context as ChatGPT Custom Instructions
/forgein export gemini           Format context as a Gemini Gem system prompt

/forgein sec                     Security check on staged git changes
/forgein sec <path>              Security check on a file or directory

/forgein optimize                Discover and install skills for your workflow

/forgein auth
  → checks ~/.config/forgein/token
  → if missing or stale: prompts user to create token at app.forgein.ai/tokens
  → stores token at ~/.config/forgein/token (chmod 600)

/forgein mem sync
  → computes sha256 of each local memory file
  → diffs against cloud manifest from api.forgein.ai/api/memory/files
  → pushes changed files, pulls files added from another machine
  → auto-runs /forgein export for any adapter files already present in project

/forgein export cursor
  → reads token from ~/.config/forgein/token
  → calls api.forgein.ai/api/adapters/cursor
  → writes response to .cursorrules in project root

1. FETCH REGISTRY
   gh api repos/forgeinai/forgein/contents/registry.json | base64 -d
   → fallback: WebFetch raw.githubusercontent.com

2. INVENTORY INSTALLED
   ls ~/.claude/commands/
   → set of already-installed skill names (exclude from results)

3. GATHER CONTEXT SIGNALS
   cat ~/.claude/CLAUDE.md          (global instructions)
   cat CLAUDE.md                    (project instructions)
   find ~/.claude/projects -name MEMORY.md | xargs cat  (memory index)
   git log --oneline -20            (recent commit topics)
   → single context string

4. SCORE SKILLS (word-boundary matching)
   for each skill not installed:
     score = 0
     for term in (skill.signals + skill.tags):
       if term matches as a whole word in context (case-insensitive):
         score += 1
   
   Whole-word rule: char before and after match must be non-alphanumeric.
   "pr" does NOT match "sprint". "git" does NOT match "digital".

5. RANK + RECOMMEND
   sort by score desc → take top 5
   show: skill name, score, description, matched terms

6. INTERACTIVE INSTALL
   default: Enter = install all
   or pick by number: "1,3"
   or "none" to cancel
   
   install: gh api .../contents/<file> | base64 -d → write to ~/.claude/commands/

---
name: feedback-commits
description: Commit message rules — no Claude/AI attribution
metadata:
  type: feedback        # user | feedback | project | reference
---

Commit messages must not mention Claude, AI, or any collaboration.

**Why:** commits must appear as the user's own organic work.
**How to apply:** never add Co-Authored-By lines. Write messages in first person.

1. GET CODE
   git diff --staged          (default)
   <path>                     (if argument given)
   
   If staged diff is empty → ask user for a path. Never silently scan.

2. SCAN 8 VULNERABILITY CLASSES
   
   Class              Severity  What to look for
   ─────────────────────────────────────────────────────────────────
   Secrets            critical  Long string literals in key/secret/token vars
   Command injection  critical  User input in subprocess/eval/shell=True
   SQL injection      high      User input concatenated into SQL strings
   Path traversal     high      User input in open()/join() without realpath
   SSRF               high      User-controlled URLs fetched server-side
   XSS                medium    User input in innerHTML/unescaped templates
   Insecure deser.    medium    pickle.loads / yaml.load / eval on external data
   Hardcoded creds    medium    Literal passwords/tokens in source or config

3. OUTPUT
   Sort: critical → high → medium → low
   Each finding: severity, file:line, class, snippet (≤80 chars), attack scenario
   
   If no findings: "✓ Clean"
   Always: remind user to run a real SAST tool for production

{
  "id": "commit",
  "command": "commit",
  "name": "Smart Commit",
  "description": "Generates conventional commit messages from staged changes.",
  "tags": ["git", "productivity", "conventional commits"],
  "signals": ["commits", "commit messages", "changelog", "semantic versioning"],
  "author": "forgein-ai",
  "version": "1.0.0",
  "file": "skills/commit.md",
  "install_as": "commit.md"
}