heating the forge...

@forgecat/anthropics_claude-plugins-official_plugin-dev — Security Risk Report | ForgeCat

anthropics_claude-plugins-official_plugin-dev

Security risk report for @forgecat/anthropics_claude-plugins-official_plugin-dev v0.0.4

Low

Profile is sourced from Anthropic's official claude-plugins-official repository (GitHub: anthropics/claude-plugins-official).
Declared as Apache-2.0 licensed, with original commit cf62a6c traceable.
Source is legitimate and well-known; no supply-chain risk detected.

Low

Content describes plugin development patterns and best practices; no instructions to manipulate the AI, exfiltrate data, or bypass security.
Agent and skill definitions are educational—they teach Claude how to help users build plugins, not how to attack systems or hide instructions.
System prompts in agents (agent-creator, plugin-validator, skill-reviewer) are transparent and focused on legitimate development tasks; no prompt injection, role hijacking, or guidance poisoning detected.
The profile does not instruct reading credentials, exfiltrating environment variables, installing malicious dependencies, or weakening security defaults.

Details

Findings

Invisible characters detected
skills/plugin-settings/SKILL.md · SKILL-011
Invisible characters detected
skills/command-development/references/documentation-patterns.md · SKILL-011
Invisible characters detected
skills/command-development/references/marketplace-considerations.md · SKILL-011
Invisible characters detected
skills/plugin-settings/references/parsing-techniques.md · SKILL-011

Evidence

agent-creator.md: 'You are an elite AI agent architect specializing in crafting high-performance agent configurations' — transparent role definition.
plugin-validator.md: 'Security Checks: No hardcoded credentials in any files, MCP servers use HTTPS/WSS not HTTP/WS' — actively promotes security.
create-plugin.md: 'Load relevant skills' and 'Use specialized agents' — legitimate delegation patterns, no hidden instructions.

Low

Agents and skills declare minimal, purpose-aligned tool access.
agent-creator uses ['Write', 'Read'] — appropriate for generating agent configurations.
plugin-validator uses ['Read', 'Grep', 'Glob', 'Bash'] — scoped to validation tasks, no file deletion or mutation.
create-plugin command uses ['Read', 'Write', 'Grep', 'Glob', 'Bash', 'TodoWrite', 'AskUserQuestion', 'Skill', 'Task'] — broad but justified for guided plugin scaffolding workflow; no shell execution beyond validation.
No alwaysApply=true rules with globs='**' detected; no excessive agency.

Details

Evidence

agents/agent-creator.md tools: ['Write', 'Read']
agents/plugin-validator.md tools: ['Read', 'Grep', 'Glob', 'Bash']
commands/create-plugin.md allowed-tools: [Read, Write, Grep, Glob, Bash, TodoWrite, AskUserQuestion, Skill, Task]

Low

No MCP servers are defined in the profile.
mcp-integration skill documents how to integrate MCP servers securely (HTTPS/WSS, scoped access), but does not instantiate any servers.
No hidden instructions in tool descriptions; no arbitrary binary execution or unrestricted network/filesystem access in the profile itself.

Details

Evidence

Profile metadata: 'mcpServers' field absent from plugin.json template.
mcp-integration skill: 'MCP servers use HTTPS/WSS not HTTP/WS' — security guidance, not a vulnerability.