Security risk report for @forgecat/anthropics_claude-plugins-official_example-plugin v0.0.4
Source Integrity
Low
Profile is sourced from Anthropic's official claude-plugins-official repository (https://github.com/anthropics/claude-plugins-official), a trusted first-party source.
Metadata clearly attributes origin and includes Apache-2.0 license; no supply-chain obfuscation or untrusted third-party dependencies.
Agent Intent
Low
Content is purely educational and demonstrative—it documents plugin structure, skill formats, and configuration options without instructing the AI to perform malicious actions.
No instructions to read credentials, exfiltrate data, ignore system prompts, install remote payloads, or weaken security defaults.
References to tools (Read, Glob, Grep, Bash) and MCP servers are presented as examples and documentation, not as directives to execute hidden or harmful behavior.
Details
Evidence
README.md: 'A comprehensive example plugin demonstrating all Claude Code extension options' — describes structure, not instructs manipulation.
skills/example-skill/SKILL.md: 'This skill demonstrates the structure and format for Claude Code plugin skills' — educational reference.
Declared tools (Read, Glob, Grep, Bash) are standard, well-scoped utilities appropriate for a reference plugin demonstrating command and skill capabilities.
No high-risk categories (file_write, file_delete, file_mutate) with unrestricted globs or alwaysApply=true; no excessive subagent or web_fetch authority.
Tool allowlists are explicitly declared in frontmatter and match the stated purpose of demonstrating plugin structure.
ForgeCat