diff --git a/forgejo-tobiasostner/SKILL.md b/forgejo-tobiasostner/SKILL.md
new file mode 100644
index 0000000..d1cf6fc
--- /dev/null
+++ b/forgejo-tobiasostner/SKILL.md
@@ -0,0 +1,70 @@
+---
+name: forgejo-tobiasostner
+description: >-
+  Manages repositories and collaboration resources on the user's Forgejo instance
+  at git.tobiasostner.de through the fj CLI. Use this skill when asked to create,
+  inspect, clone, migrate, or configure a Forgejo repository there, or to work
+  with its issues, pull requests, releases, actions, tags, users, or organizations.
+  Do not use for local-only Git work, GitHub or other forges, or administration of
+  the underlying server or Forgejo deployment.
+license: MIT
+compatibility: >-
+  Requires the fj CLI, an authenticated git.tobiasostner.de account, and network
+  access. Repository remote changes additionally require a local Git checkout.
+metadata:
+  short-description: Operate git.tobiasostner.de through fj
+---
+
+# Forgejo at git.tobiasostner.de
+
+## Critical rules
+
+- Use `fj`; do not SSH into the underlying server unless the user explicitly requests server administration.
+- Pass `-H git.tobiasostner.de` so commands cannot target another configured forge accidentally.
+- Never print or retrieve access tokens or passwords, and never store them outside fj's credential handling. Use `fj auth` for authentication state.
+- Inspect current state before mutating it. Ask before destructive operations such as deleting repositories, releases, tags, issues, or branches.
+- Preserve an existing repository's visibility when recreating or migrating it. If no source establishes visibility, ask whether it should be public or private.
+- Read `fj <command> --help` before using unfamiliar or version-sensitive flags.
+
+## Workflow
+
+1. Confirm the client and account:
+   ```sh
+   command -v fj
+   fj auth list
+   fj whoami -H git.tobiasostner.de
+   ```
+   Stop and ask the user to authenticate with `fj auth login -H git.tobiasostner.de` or `fj auth add-token -H git.tobiasostner.de` if the target account is unavailable. Do not request the credential in chat.
+
+2. Inspect local and remote context relevant to the request:
+   ```sh
+   git status --short --branch
+   git remote -v
+   fj repo view OWNER/REPO -H git.tobiasostner.de
+   ```
+   A `not found` result is expected when confirming that a new repository name is free.
+
+3. Use the narrow matching `fj` command group, such as `fj repo`, `fj issue`, `fj pr`, `fj release`, `fj actions`, `fj tag`, `fj user`, or `fj org`. Check that group's `--help` instead of guessing syntax.
+
+4. For repository creation:
+   - Match established visibility; add `--private` only for a private repository.
+   - If the requested Git remote name does not exist, let `fj repo create` configure it with `--remote`.
+   - If that remote already exists, choose an unused temporary remote name and pass it to `fj repo create --remote`. After creation succeeds, read the exact generated URL with `git remote get-url` before changing the requested remote.
+   - Before replacement, inspect every fetch URL with `git remote get-url --all` and every explicit `remote.<remote-name>.pushurl` entry with `git config --get-all`. Do not use `git remote get-url --push` to detect explicit push URLs because it falls back to the fetch URL.
+   - Preserve additional fetch and explicit push URLs unless the user asked to replace the whole remote. For whole-remote replacement, use `git config --replace-all` on `remote.<remote-name>.url` so one new URL replaces every old fetch URL, then clear all `remote.<remote-name>.pushurl` entries so pushes inherit it. Remove the temporary remote only after validating the requested remote.
+   - Omit `--ssh` to honor fj's configured transport default. Do not run `fj auth use-ssh` as an inspection command: without a boolean argument it enables SSH. Do not guess the instance's SSH username or URL shape.
+
+5. Validate the requested outcome:
+   ```sh
+   fj repo view OWNER/REPO -H git.tobiasostner.de
+   git remote get-url --all REMOTE
+   git remote get-url --push --all REMOTE
+   ```
+   For other resources, run the corresponding non-mutating `fj` view/list/status command. Report the Forgejo URL and any local remote changes.
+
+## Failure handling
+
+- On authentication failure, stop and direct the user to `fj auth login -H git.tobiasostner.de` or `fj auth add-token -H git.tobiasostner.de`.
+- On name collision, inspect the existing repository and ask whether to reuse it; never delete or overwrite it automatically.
+- On remote-name collision, preserve the existing URL until repository creation succeeds, then change only the requested remote.
+- Do not fall back to the Forgejo HTTP API, browser automation, or server shell merely because an `fj` command failed. Diagnose with `fj --help`, authentication checks, and non-mutating inspection first; ask before changing approach.