heating the forge...

@forgecat/anthropics_claude-plugins-official_feature-dev — Security Risk Report | ForgeCat

anthropics_claude-plugins-official_feature-dev

Security risk report for @forgecat/anthropics_claude-plugins-official_feature-dev v0.0.4

Low

Profile is sourced from Anthropic's official Claude plugins repository (github.com/anthropics/claude-plugins-official), a trusted first-party source.
Metadata indicates Apache-2.0 license and clear attribution to original author (Anthropic), with version tracking and commit reference.

Low

Content describes a legitimate feature development workflow with codebase analysis, architecture design, and code review—standard software engineering practices with no hidden manipulation directives.
Agent instructions (code-architect, code-explorer, code-reviewer) focus on reading existing code, analyzing patterns, and providing design guidance; they do not instruct exfiltration, credential theft, system prompt leakage, or malicious knowledge poisoning.
No instructions to ignore previous directives, hide instructions, fetch external payloads, or weaken security defaults; no guidance poisoning (e.g., typosquatted packages or backdoored templates).

Details

Evidence

code-architect.md: 'Deliver a decisive, complete architecture blueprint... Include: Patterns & Conventions Found, Architecture Decision, Component Design, Implementation Map, Data Flow, Build Sequence, Critical Details'—standard architectural guidance.
code-explorer.md: 'Provide a complete understanding of how a specific feature works by tracing its implementation... Include: Entry points, Step-by-step execution flow, Key components, Architecture insights'—legitimate code analysis.
code-reviewer.md: 'Review code against project guidelines... Verify adherence to explicit project rules... Identify actual bugs... Evaluate significant issues'—standard code review practices.
feature-dev.md Phase 3: 'Wait for answers before proceeding to architecture design'—explicit user consent checkpoints, no coercion.

PRM-000Medium

All three agents (code-architect, code-explorer, code-reviewer) declare the 'KillShell' and 'BashOutput' tools, which imply shell-interaction capability; this is broader than pure read-only codebase analysis.
WebFetch and WebSearch are also granted to all agents, enabling outbound network access beyond what local code exploration strictly requires.
The stated purpose (codebase exploration, architecture design, code review) could be accomplished with read-only filesystem tools; the shell and network tools represent moderate excess authority.

Details

Evidence

agents/code-architect.md tools: 'Glob, Grep, LS, Read, NotebookRead, WebFetch, TodoWrite, WebSearch, KillShell, BashOutput'
agents/code-explorer.md tools: 'Glob, Grep, LS, Read, NotebookRead, WebFetch, TodoWrite, WebSearch, KillShell, BashOutput'
agents/code-reviewer.md tools: 'Glob, Grep, LS, Read, NotebookRead, WebFetch, TodoWrite, WebSearch, KillShell, BashOutput'

Low

No MCP servers are defined in the profile; all tool access is declared inline in agent markdown files.
Tool declarations are explicit and scoped to named categories (Glob, Grep, LS, Read, etc.); no hidden instructions embedded in tool descriptions.
No arbitrary binary execution, unrestricted filesystem access, or unknown external hosts are configured.

Details

Evidence

Profile metadata section 'MCP servers (untrusted data)' lists: '(none)'.
All agent tool access is declared as simple string lists (e.g., 'tools: Glob, Grep, LS, Read...') with no embedded instructions or dynamic configuration.