No guessed platform capabilities.
An adapter cannot declare support for anything without an evidence URL and a verification date. If it tries, the build fails.
SkillForge is a control plane for AI skills, built on a home AI lab and served from http://localhost:4100. It exists because the same instructions should not live in five folders and drift into five different truths.
A skill is a small package — instructions, scripts, resources — that teaches an agent a job. Claude Code wants one layout, Codex another, Gemini CLI another, Cursor and Copilot another two. So the copies get made. Then one gets fixed and the other four don't, and nobody can say which one is current or what the others quietly lost.
The drift, in one week. Four of these are wrong and nobody knows which.
01 — One canonical skill
Instructions, scripts, resources and a declared capability list in one Zod-validated model. This is the only copy you edit.
02 — Seven builds
One shared SKILL.md implementation plus a declarative spec per platform: Claude, Claude Code, Codex, Gemini CLI, Cursor, Copilot and the Agent Skills open standard.
03 — The Semantic Gap Report
Every capability a target cannot express gets an entry: what was lost, and what the compiler did about it — rewritten, substituted, or dropped with a note.
04 — Evidence, not vibes
An adapter cannot claim support without a vendor documentation URL and a verification date. A test fails the build if it tries.
release-notes/SKILL.mdcanonical
Semantic Gap Report
Claude Code → Gemini CLI · 2 gaps · 1 rewritten, 1 dropped
evidence: 4 vendor docs, all dated
7 / 7 built0 silent losses
Rules that live in a README are wishes. These two fail the build when an adapter breaks them, so the promise survives contact with a deadline.
An adapter cannot declare support for anything without an evidence URL and a verification date. If it tries, the build fails.
Every capability a skill uses that a target lacks produces a Semantic Gap entry saying what was done about it. Enforced the same way.
ZIPs, pasted SKILL.md files and GitHub URLs are parsed and analysed, never run. Every outbound fetch goes to a fixed HTTPS allow-list; uploads are size- and count-limited and checked for path traversal and symlinks.
localhost:4100 here, your LAN address if you set an access code. Secrets stay in .env.local, the model key never reaches the browser, and every state-changing call must come from SkillForge's own pages.
The same rule that governs the gap report governs this page: say what is missing, in public.
The full list of what is not yet protected is in docs/architecture/overview.md §(e). It gets shorter in public, on purpose.
One Next.js app on top of TypeScript engine packages. packages/core depends on nothing; nothing depends on the web app. Adapters, validation, security, the LLM gateway, the builder and the connectors all sit between them.
core · adapters · validation · security · llm · builder · connectors · storage · apps/web
Hover or focus a package to read its job. Every arrow points inward; nothing depends on the web app.
core — Canonical Skill Model (Zod schema), capability vocabulary, findings model, adapter contract.
adapters — One shared SKILL.md implementation plus a declarative spec per platform; gap reports; safe zip/unzip.
validation — Deterministic structure and quality checks.
security — Static detectors, readiness rubric (verdict · coverage · A–D grades), inert test fixtures.
llm — Provider-neutral LLM gateway; validate-and-retry (default: GLM-5.3 on Ollama Cloud).
builder — Intent interview, skill drafting, revision, injection-hardened AI review, neutral summaries, Try it.
connectors — Registry listings, GitHub fetch pinned to a commit, search index and live search — behind an SSRF allow-list.
storage — Files-on-disk storage behind an interface; snapshots; audit log.
SkillForge is in early access. Tell me which agents your team actually runs, which skills you keep rewriting, and what you would need before you trusted a compiler with them. Security questions are welcome and get specific answers.
hello@skillforge.devReplies usually within a week. It is one person.
Or run it yourself
pnpm install
Copied
pnpm build
Copied
pnpm service:install
Copied
Then http://localhost:4100 — starts at login, restarts after a crash or reboot.