Security risk report for @forgecat/0xsarwagya_ontoly v0.1.2
Source Integrity
SRC-010Medium
Profile depends on external GitHub repository (https://github.com/0xsarwagya/ontoly) and npm registry package; no commit hash pinning or checksum validation in MCP definition.
Installation instructions reference public npm registry and GitHub without integrity checks; RC release status increases risk of unvetted changes.
Details
Findings
Data exfiltration
README.md · SKILL-002
Agent Intent
Low
Content is purely educational documentation describing legitimate software analysis workflows (architecture review, dependency analysis, security review, etc.) with no instructions to manipulate the agent or exfiltrate data.
Skill definitions explicitly forbid implementing compiler logic or business logic in the skill layer; they enforce graph-first evidence and fallback rules, which are defensive guardrails.
No prompt injection, system prompt leakage, guidance poisoning, or credential exfiltration instructions present; references to external URLs are for documentation and legitimate MCP capability queries.
Details
Evidence
Skill boundaries state: 'Do not implement compiler, query, MCP, SDK, or business logic in the skill.'
Workflow enforces: 'Inspect repository files only when Ontoly cannot answer, confidence is low, or source snippets are needed for confirmation.'
All skills declare 'LLM Enhancement' and require evidence citation (node ids, graph hash, confidence), preventing blind agent execution.
Permissions
Low
MCP server is scoped to Ontoly CLI capabilities (graph queries, static analysis, tracing) with no shell, file_write, file_delete, or arbitrary code execution permissions declared.
Skills are read-only analysis tools that query the Software Graph and return evidence; they do not request file mutation, network exfiltration, or subagent spawning.
Authority matches stated function: architecture review, dependency analysis, security review, and configuration audit via deterministic graph queries.
Skill descriptions consistently state 'use Ontoly graph' and 'cite evidence'; no alwaysApply rules or glob-based file access.
Capability matrix lists only query operations: `FindDependencies`, `TraceRequestLifecycle`, `FindAuthenticationFlow`, etc.
MCP Risk
MCP-000Medium
The MCP server runs a third-party npm RC package (`@0xsarwagya/ontoly-cli@1.0.0-rc.5`) via `npx -y`, which auto-downloads and executes without integrity verification — a known supply-chain risk pattern.
The tool descriptions and skill instructions appear clean with no hidden instructions embedded in MCP tool definitions, and the server is scoped to local stdio (not an external network endpoint).
The RC (release candidate) status of the pinned version means the package API and behavior may still change, and RC packages on npm are sometimes less scrutinized than stable releases.
README.md: 'Ontoly's current Release Candidate is `v1.0.0-rc.5`' — RC status confirmed
No hidden instructions found in tool descriptions; all capability names (`ExplainArchitecture`, `FindDeadCode`, etc.) are straightforward and match documented functionality
ForgeCat