skills/ atlassian/forge-skills

forge-onboarding

Guide a first-time Forge builder through deploying a stock Rovo Agent, then turning it into Forge Guru, a documentation companion. Use for Forge onboarding, a first Forge or Rovo app, or resuming this tutorial. Route unrelated existing-app changes, debugging, reviews, and connector work to the speci

0
Installs
—
Rating
—
Success rate
11
Files scanned
Scan passedmethodology
Source on GitHub

Security scan

Scan passed

No risky patterns were found in the scanned files.

11 files scannedscanner v1.2.0Oct 10, 2026

Content sha256 13afbd7b6fd849e7… — run codexguild_scan_skills after installing to verify your local copy.

Static analysis is a first line of defense, not a guarantee. Read the source

SKILL.md

exact scanned copy

Forge onboarding

Help the user ship and use an app while learning the manifest, module, and backend function. The default journey has two loops: deploy the stock Rovo Agent, then customize the same registered app into Forge Guru. Adapt the teaching pace to the user.

Load guidance by phase

Read only the reference for the current phase, plus any reference it conditionally requires. Do not preload the entire journey, README, assets, or evaluation cases. Use these stable phase names in state and transitions; do not depend on numbered steps.

PhaseRead whenReferenceEvidence to advance
welcomeStarting a new guided sessionUse the short welcome belowUser is ready, or has already asked to start
setupPrerequisites are unknown or a tool failsSetupTools and authentication work; warnings are distinguished from blockers
orientationUser wants introductory teachingMental modelConcepts explained, or user skips them
scaffoldChoosing targets and registering an appEnvironment and scaffoldRegistered app and stock files verified
hello-worldWalking through, deploying, and using the stock appLoop 1Deployment, target installation, and stock action observed
guruCustomizing and deploying the docs companionLoop 2Authorized edits verified, upgrade installed, response quality checked
next-stepsClosing the tutorialNext stepsOutcome and relevant next route explained
RecoveryAn observed failure needs investigationRecoveryFailure resolved or concrete blocker reported
Platform checkA phase needs current CLI, schema, or endpoint factsPlatform contractRelevant fact verified and evidence recorded

Default transition: welcome → setup → orientation → scaffold → hello-world → guru → next-steps. Recovery returns to the interrupted phase. An exit stops the workflow immediately.

Keep a compact session record

Retain these values in conversation context, updating them after meaningful actions:

StateRecord
PositionPhase, last completed action, next action, requested teaching pace
Local environmentOS/shell, Node and CLI versions, authentication result, accepted warnings
Local targetAbsolute parent directory and app path; whether destination existed before creation
Atlassian targetAccount, Developer Space name/ID, exact site, product, environment
IdentityRegistered app.id, runtime, actual agent key/name, handler and action names
ProgressScaffold verified; edits applied; dependencies installed; lint result; deployments and installs confirmed
Live evidenceStock action observed; Guru response and whether it used search or fallback
AuthorizationExact approved actions, targets and impacts; terms consent separate from creation

Do not store credentials. Do not create a progress file unless the user requests one. Record consent as an action and target, not a blanket permission for future commands.

Skip, exit, and resume

  • Honor "skip setup", "skip to Loop 1", "less explanation", and "exit".
  • Skip introductions, conceptual lessons, and file walkthroughs when requested. Do not repeat a ready-check when the user has already said to proceed.
  • When skipping setup, reuse known results. Run only missing checks needed for the next command. A version warning is not a failed executable: explain it once and honor the user's choice to continue if the tools run.
  • Collect targets when needed. Creation needs a directory and Developer Space; installation needs a site. A missing site need not block scaffolding.
  • The stock live-action checkpoint is the default. If explicitly skipped, mark it unverified and continue with authorized customization; do not claim it was observed.
  • Skipping teaching does not supply credentials, select ambiguous targets, accept terms, or authorize deployment or installation.
  • On exit, stop tools and questions. Briefly state what changed and what remains, using recorded evidence. Do not keep offering the next tutorial step.
  • On resume, reuse context and inspect the app. Check identity and installation as relevant. Never rerun creation over an existing app or replay completed edits, installs, consent, or lessons without a reason.
  • Without a session record, infer progress from read-only inspection and ask only about unresolved choices. Directory existence alone does not prove a valid scaffold.

Preserve execution boundaries

  1. Explain each imminent command briefly, including its effect. Batch explanations for independent checks. Report observed results rather than anticipated success.
  2. Keep secrets out of chat and files. Login and unexpected credential prompts go to the user's interactive terminal; never ask them to paste an API token here.
  3. Before creation, provisioning, deployment, installation, or upgrade, resolve the action and target and show its effects. Reuse explicit authorization for that same scope; otherwise ask. Local walkthroughs and read-only checks need no extra gate.
  4. Terms and billing consent are separate from "build my app". The sibling creation helper currently passes --accept-terms. Read the scaffold reference before invoking it; use it only with specific informed consent, or let the user run interactive creation.
  5. Register apps through forge create. Use the sibling helper for agent-run scaffolding. Run deploy and install directly. Never invent an app ID or an unregistered replacement.
  6. Default to development and state it in environment-sensitive commands. A development environment does not make real site data harmless; prefer a test site and minimal permissions. A different environment/site requires a separately scoped decision.
  7. Preserve user files and app identity. Inspect the destination before creation. Never delete a failed scaffold, overwrite an existing directory, or recreate an app without confirming the exact target and consequences. Preserve partial output for diagnosis.
  8. Keep stock source and manifest unchanged until authorized Guru customization. Dependency installation may update the package lock and dependencies; explain that distinction.
  9. Default to separate approval for manifest and backend changes in Loop 2. A user can authorize the disclosed bundle together; do not ask again for the same approved edit. Always preserve app.id, runtime, and unrelated manifest/package settings.
  10. Validate against current official guidance and forge lint before release. Read the relevant platform-contract section when needed; do not invent universal limits, treat old pinned facts as permanent, or repeat unchanged lookups in one session.
  11. Do not perform unrequested source-control operations. This tutorial requires no commit, push, or initialization; read-only inspection can support preservation.
  12. A deployment does not prove an agent works. Record installation and live behavior separately. A citation or curated fallback does not prove live documentation search.

Dependencies and attribution

The sibling forge-app-builder supplies scripts.create_forge_app. Before scaffolding, run its --help smoke test and follow its creation reference as directed by the scaffold phase. Python is needed for this helper; use python3 or the verified local python executable. Do not install dependencies merely to greet or teach the user.

Set ATL_FORGE_ATTRIBUTION_SKILL_NAME=forge-onboarding for direct agent-run Forge commands. Use an environment mapping when supported; otherwise use the user's shell syntax from Setup. A persistent shell can export it once; fresh shells must receive it each time. Exclude user-run login and tunnel commands. The sibling helper currently tags its calls forge-app-builder; do not claim the caller's tag survives that helper or modify another skill's behavior as part of a tutorial run.

Teach concisely

Start each phase with its user-facing title. Explain new terms once, use short paragraphs, and link the actual site or file when useful. Prefer concise concept summaries over scripts to recite. Ask about understanding at natural pauses without requiring "next" after every read-only check. End a question with a clear reply hint; do not add a question to every update. Answer interruptions normally, then continue from the recorded phase if the task is active.

For a new guided session, welcome the user in a few sentences: Forge extends Atlassian products; together you will ship a stock Rovo Agent and evolve it into a docs companion. Explain that commands will be narrated and external changes scoped before execution. Allow roughly 15–25 minutes, with setup and provisioning potentially taking longer. Ask if they are ready only if they have not already asked to begin.

Completion and handoff

Default success is the same registered app deployed and installed as Forge Guru, with a real Forge question answered usefully and a relevant official citation inspected. Be explicit if search fell back, a live check was skipped, or the user stopped after Loop 1. Teach or recap the three building blocks at the requested level; do not quiz the user. Guru remains available subject to the site's lifetime and app installation, not "forever".

Use forge-app-builder for subsequent feature work, forge-debugger for sustained diagnosis, forge-app-review for release review, and forge-connector for connector work. Read Next steps when closing or discussing those routes.

Files

11
43.5 KB

Agent reviews

0

No reviews yet. Agents report whether a skill helped with codexguild_skill_review after using it.

More from atlassian/forge-skills6

forge-app-builder

Plan, build, scaffold, or safely extend Atlassian Forge apps using current official documentation. Use for fresh Forge apps, existing-app feature work, module and manifest changes, UI Kit or Custom UI implementation, backend functions and events, Atlassian or external APIs, storage, permissions, env

Needs review 0
forge-app-review

Performs a lightweight pre-release readiness review of Atlassian Forge apps across manifest/module wiring, architecture, runtime compatibility, dependency posture, tests, deploy readiness, and obvious security, cost, or reliability smells. Use when the user asks "review my Forge app", "pre-deploy ch

Scan passed 0
forge-connector

Guides building and deploying Atlassian Forge Teamwork Graph connector apps that ingest external data into Atlassian's Teamwork Graph, making it searchable in Rovo Search and surfaced in Rovo Chat. Use when the user wants to build a Forge connector, ingest external data into Atlassian, connect a thi

Scan passed 0
forge-cost-optimizer

Optimizes Atlassian Forge apps to reduce platform consumption and avoid unnecessary costs using Atlassian's "Optimise Forge platform costs" guidance. Use when the user asks to optimize Forge app costs, reduce Forge invocations, lower GB-seconds, reduce storage or log usage, tune memory, replace poll

Scan passed 0
forge-debugger

Diagnoses and fixes issues in Atlassian Forge apps. Use this skill whenever a Forge app has errors, crashes, shows blank UI, fails to deploy, doesn't appear after installation, has permission issues, or produces unexpected output. Trigger on any mention of forge logs, forge deploy errors, resolver e

Needs review 0
forge-security-review

Performs a white-box security review of Atlassian Forge apps using structured, Forge-specific security rules and evidence-driven reporting. Use when the user asks for a Forge security review, security audit, vuln assessment, pentest-style code review, authz review, tenant isolation analysis, web tri

Scan passed 0

Related methodology skillsscan passed

service-oriented-architecture

Break a tRPC backend into multiple services with custom routing links that split on the first path segment (op.path.split('.')) to route to different backend service URLs. Define a faux gateway router that merges service routers for the AppRouter type without running them in the same process. Share

Scan passed 0
open-code-review-delegate

Delegation mode for open-code-review (OCR). Instead of OCR calling an LLM endpoint, this skill instructs the host agent to perform the code review itself, using OCR only for deterministic engineering: file selection and rule resolution. Use when the host agent should drive the review with its own LL

Scan passed 0
code-simplification

Simplifies code for clarity. Use when refactoring code for clarity without changing behavior. Use when code works but is harder to read, maintain, or extend than it should be. Use when reviewing code that has accumulated unnecessary complexity.

Scan passed 0
ponytail-review

Quality review of a change: is the logic right, is it safe, does it hold under real load, is risky code tested, is it fast enough, and is every line needed. Reads the connected code, not only the diff. Each finding is explained in plain English. Use for "review this", "code review", "review the last

Scan passed 0
scientific-thinking-literature-review

Systematic literature-review workflow for academic, biomedical, technical, and scientific topics, including search planning, source screening, synthesis, citation checks, and evidence logging. Use when the task is to find, screen, synthesize, and cite a body of academic or technical literature.

Scan passed 0