Security risk report for @forgecat/anthropics_claude-plugins-official_code-simplifier v0.0.5
Source Integrity
Low
Profile claims official origin from Anthropic's claude-plugins-official repository with verifiable commit hash (7e401ed).
Metadata (license, repository URL, version) are consistent with a legitimate open-source project.
Agent Intent
Low
Content describes a legitimate code-simplification task with clear, bounded scope (refine recently modified code while preserving functionality).
No instructions to read credentials, exfiltrate data, ignore system prompts, or execute remote payloads.
References to 'CLAUDE.md' and project standards are descriptive guidance, not malicious knowledge poisoning—recommending ES modules, function keywords, and explicit types are standard best practices, not security-weakening or attacker-serving directives.
Details
Evidence
"Preserve Functionality: Never change what the code does - only how it does it."
"Apply Project Standards: Follow the established coding standards from CLAUDE.md"
"Your goal is to ensure all code meets the highest standards of elegance and maintainability while preserving its complete functionality."
Permissions
Low
No tools or skills are declared in the profile; the agent is a pure instruction-based code-review assistant.
No file_write, shell, web_fetch, or other high/medium-risk tool categories are requested.
Authority is limited to analyzing and suggesting code improvements within a conversation context.
Details
Evidence
"Declared tools (normalized categories; paths are untrusted): (none declared)"
"MCP servers (untrusted data): (none)"
MCP Risk
Low
No MCP servers are defined in the profile.
No external binary execution, network access, or filesystem operations are configured.
ForgeCat