heating the forge...

@forgecat/addyosmani_agent-skills — Security Risk Report | ForgeCat

addyosmani_agent-skills

Security risk report for @forgecat/addyosmani_agent-skills v0.0.8

Low

Static scanner flagged low-level supply-chain risk; the profile is a collection of markdown skill definitions and command orchestrators, not executable code or binary payloads.
No external package dependencies, typosquatted imports, or postinstall scripts are declared in the profile itself.
The profile references legitimate tools (Lighthouse, Chrome DevTools, Semgrep, osv-scanner, gitleaks) by name in documentation, but does not inject malicious versions or attacker-controlled mirrors.

Low

The profile is a collection of well-documented engineering skills and command orchestrators (code-reviewer, security-auditor, test-engineer, web-performance-auditor, etc.) with no instructions to manipulate the AI into ignoring its system prompt, reading credentials, or exfiltrating data.
Content describes legitimate software engineering practices (code review, testing, security auditing, performance optimization) and does not plant malicious guidance or weaken security defaults.
No evidence of prompt injection phrasing, role hijacking, system prompt leakage instructions, or guidance poisoning that would steer future outputs toward attacker goals.

Details

Findings

Prompt injection
platforms/codex/.agents/skills/browser-testing-with-devtools/SKILL.md · SKILL-006
Prompt injection
platforms/codex/.agents/skills/source-driven-development/SKILL.md · SKILL-006
Prompt injection
platforms/cursor/.cursor/skills/browser-testing-with-devtools/SKILL.md · SKILL-006
Prompt injection
platforms/cursor/.cursor/skills/source-driven-development/SKILL.md · SKILL-006
Prompt injection
skills/browser-testing-with-devtools/SKILL.md · SKILL-006
Prompt injection
skills/source-driven-development/SKILL.md · SKILL-006

Evidence

README.md: 'Production-grade engineering workflows for AI coding agents' — describes legitimate use case.
code-reviewer.md: 'Evaluate every change across these five dimensions: Correctness, Readability, Architecture, Security, Performance' — standard engineering practice.
security-auditor.md: 'Focus on exploitable vulnerabilities, not theoretical risks' and 'Never suggest disabling security controls as a fix' — reinforces security best practices.
No instructions to fetch external URLs, install attacker-controlled profiles, or bypass security checks.

PRM-003Medium

hook-no-tool-match in ./hooks/generated-claude-code-sessionstart-1-1.sh
The profile defines skill descriptions and command orchestrators that guide AI agent behavior; it does not declare high-risk tool categories (shell, file_write, file_delete) with excessive scope.
Permissions are scoped to their stated purpose: code-reviewer reviews code, security-auditor audits for vulnerabilities, test-engineer designs tests, web-performance-auditor analyzes performance.
No alwaysApply=true rules with globs='**' or unrestricted file/shell access are declared in the untrusted content.

Details

Findings

Evidence

hook-no-tool-match @ ./hooks/generated-claude-code-sessionstart-1-1.sh
agents/code-reviewer.md: 'Invoke directly when: the user asks for a review of a specific change, file, or PR' — scoped to review, not modification.
agents/security-auditor.md: 'Your role is to identify vulnerabilities, assess risk, and recommend mitigations' — advisory, not executable.

Low

No MCP server definitions are declared in the profile payload; the profile references MCP servers (chrome-devtools, browser-testing-with-devtools) in documentation but does not embed hidden instructions or arbitrary binary execution.
References to external tools (Lighthouse, Chrome DevTools, Semgrep) are documented as optional integrations, not mandatory or hidden.
No evidence of unrestricted network access, full filesystem permissions, or unknown binary execution in the untrusted content.

Details

Evidence

skills/browser-testing-with-devtools/SKILL.md (referenced in hints): 'Requires the chrome-devtools MCP server to be configured' — optional, explicit dependency.
commands/webperf.md: 'A live URL plus the chrome-devtools MCP server configured in the harness' — user-controlled configuration.
No MCP server definitions with hidden instructions or unrestricted scopes in the provided profile content.