forge-loop
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a structured framework for long-horizon autonomous development tasks. It uses an internal state file (
.forge/loop-state.json) to manage progress across multiple sessions and issues. - [COMMAND_EXECUTION]: The instructions utilize standard, well-known development tools including
gitand the GitHub CLI (gh) for common operations such as managing worktrees, updating labels, and polling CI status. These commands are constrained to the context of the current repository. - [INDIRECT_PROMPT_INJECTION]: The orchestrator reads external project files such as
forge.tomlandCLAUDE.mdto configure its behavior. It also processes issue content retrieved via other sub-agents. These are standard inputs for a development-focused agent and are handled within a defined state machine. - [REMOTE_CODE_EXECUTION]: While the skill orchestrates code changes and CI triggers, it does so through controlled sub-agents (
/autodev,/review-pr) rather than executing arbitrary remote scripts or unverified dependencies.
Audit Metadata