Security risk report for @forgecat/anthropics_claude-plugins-official_claude-code-setup v0.0.5
Source Integrity
Low
Profile is sourced from Anthropic's official Claude plugins repository (https://github.com/anthropics/claude-plugins-official/tree/main/plugins/claude-code-setup), a trusted first-party source.
Metadata clearly attributes authorship to Anthropic (Isabella He, isabella@anthropic.com) and includes original commit hash (cf62a6c) for verification.
Licensed under Apache-2.0, a permissive open-source license with no supply-chain red flags.
Agent Intent
Low
Profile is a read-only codebase analyzer that generates recommendations; it does not instruct the agent to ignore instructions, exfiltrate data, or modify files.
Skill explicitly states 'This skill is read-only. It analyzes the codebase and outputs recommendations. It does NOT create or modify any files.'
Reference documentation describes common automation patterns (hooks, MCP servers, skills) for legitimate development workflows; no hidden instructions to manipulate the agent or leak system prompts.
Details
Evidence
"This skill is read-only. It analyzes the codebase and outputs recommendations. It does NOT create or modify any files."
"Analyze codebase patterns to recommend tailored Claude Code automations across all extensibility options."
No instructions to read credentials, exfiltrate data, or reveal system prompts; all guidance is constructive and educational.
Permissions
Low
Skill declares tools: Read, Glob, Grep, Bash — all appropriate for codebase analysis and pattern detection without modification.
No file_write, file_delete, or file_mutate permissions; skill is explicitly read-only and cannot modify the codebase.
Bash access is scoped to detection commands (ls, cat, grep patterns) for project type inference, not arbitrary execution.
Details
Evidence
"tools: Read, Glob, Grep, Bash" — all read-only or safe inspection operations.
"Detect project type and tools: ls -la package.json pyproject.toml..." — inspection only, no mutations.
No alwaysApply rules, no globs="**" wildcards, no high-risk tool categories.
MCP Risk
Low
No MCP servers are defined or bundled in this profile; it only documents and recommends MCP servers for users to install separately.
Reference documentation (mcp-servers.md) describes legitimate, well-known MCP servers (context7, Playwright, GitHub, AWS, Supabase) with clear use cases and detection patterns.
No hidden instructions in tool descriptions; all MCP recommendations are transparent and tied to codebase signals (e.g., 'if React detected, recommend Playwright').
Details
Evidence
"MCP servers (untrusted data): (none)" — no MCP servers bundled.
MCP reference documentation lists official, documented servers with clear purposes and detection logic.
No arbitrary binary execution, no unrestricted network access, no hidden credentials in MCP definitions.
ForgeCat