Security risk report for @forgecat/anthropics_claude-plugins-official_code-review v0.0.3
Source Integrity
Low
Profile is sourced from Anthropic's official claude-plugins-official repository (https://github.com/anthropics/claude-plugins-official), a trusted first-party source.
Metadata clearly attributes origin to Anthropic with specific commit hash (cf62a6c) and Apache-2.0 license, enabling verification.
Agent Intent
Low
Content describes a legitimate code review automation workflow with no instructions to manipulate the AI, exfiltrate data, or bypass security controls.
The profile documents multi-agent architecture, confidence scoring, and filtering logic—all standard software engineering practices for reducing false positives.
No prompt injection, system prompt leakage, guidance poisoning, or malicious knowledge installation is present; the instructions are transparent about agent tasks and filtering thresholds.
Details
Evidence
Step 1-5 outline standard code review tasks: checking PR eligibility, reading CLAUDE.md guidelines, summarizing changes, and launching independent review agents.
Step 5 explicitly instructs agents to score confidence 0-100 and filter issues below 80, with clear false-positive examples (pre-existing issues, linter catches, nitpicks).
No instructions to read ~/.ssh, ~/.aws, .env, or exfiltrate data; no instructions to hide/deny the profile itself; no remote payload installation.
Permissions
PRM-000Medium
Allowed tools are scoped to GitHub CLI operations (gh pr, gh issue, gh search) with specific subcommands, which is appropriate for a code review automation tool.
The tool set is narrower than shell access and focused on PR/issue interaction, but gh pr comment and gh pr diff do allow reading and posting to repositories, which is broader than minimal.
No file_write, file_delete, or arbitrary shell execution is declared, reducing risk to medium rather than high.
The wildcard (*) on gh subcommands is broad but constrained to GitHub CLI, not arbitrary shell.
No file system mutation, deletion, or unrestricted command execution is permitted.
MCP Risk
Low
No MCP servers are declared in the profile, eliminating risks from hidden tool descriptions, arbitrary binary execution, or unrestricted network/filesystem access.
The profile relies only on GitHub CLI (gh), which is a well-known, scoped binary with explicit authentication and repository-specific permissions.
Details
Evidence
MCP servers section is empty: (none)
All external interaction is via gh CLI with documented GitHub integration, not arbitrary HTTP or binary execution.
ForgeCat