heating the forge...

@forgecat/anthropics_claude-plugins-official_plugin-dev — Security Risk Report | ForgeCat

anthropics_claude-plugins-official_plugin-dev

Security risk report for @forgecat/anthropics_claude-plugins-official_plugin-dev v0.0.8

Low

Profile is sourced from Anthropic's official claude-plugins-official repository (GitHub link provided in README), with commit hash and Apache-2.0 license documented.
Static scanner flagged low-level source risk; no supply-chain poisoning detected in the provided content—no typosquatted dependencies, no attacker-controlled package recommendations, no backdoored code templates.

Low

Content is educational and descriptive: agents/agent-creator.md, agents/plugin-validator.md, and agents/skill-reviewer.md document legitimate plugin development workflows with no instructions to manipulate the AI, exfiltrate credentials, or hide instructions.
Skills and agents teach best practices (e.g., 'validate plugin structure', 'review skill quality', 'create agent configurations') without injecting malicious guidance or poisoning future outputs.
No system prompt leakage instructions, no guidance to disable security defaults, no directives to install remote payloads or read ~/.ssh/.aws/.env files.

Details

Findings

Invisible characters detected
skills/plugin-settings/SKILL.md · SKILL-011
Invisible characters detected
skills/command-development/references/documentation-patterns.md · SKILL-011
Invisible characters detected
skills/command-development/references/marketplace-considerations.md · SKILL-011
Invisible characters detected
skills/plugin-settings/references/parsing-techniques.md · SKILL-011
Invisible characters detected
platforms/cursor/.cursor/skills/plugin-settings/SKILL.md · SKILL-011
Invisible characters detected
platforms/cursor/.cursor/skills/command-development/references/documentation-patterns.md · SKILL-011
Invisible characters detected
platforms/cursor/.cursor/skills/command-development/references/marketplace-considerations.md · SKILL-011
Invisible characters detected
platforms/cursor/.cursor/skills/plugin-settings/references/parsing-techniques.md · SKILL-011
Invisible characters detected
platforms/codex/.agents/skills/plugin-settings/SKILL.md · SKILL-011
Invisible characters detected
platforms/codex/.agents/skills/command-development/references/documentation-patterns.md · SKILL-011

PRM-001High

agents/agent-creator.md declares tools: [file_read, file_write]—write access to arbitrary files is high-risk and unrelated to the stated purpose of 'generating agent configurations'; agent creation should only read templates and write to designated agent/ directory.
agents/plugin-validator.md declares tools: [file_read, glob, grep, shell]—shell execution (arbitrary bash) combined with glob/grep file enumeration is high-risk for a validation tool; validation should be read-only analysis, not command execution.
agents/skill-reviewer.md declares tools: [file_read, glob, grep]—read-only access is appropriate for review, but glob/grep on untrusted plugin content could enable information disclosure if combined with exfiltration (lower risk in isolation).
Static scanner flagged permissions/high-risk-tools on agent-creator.md and plugin-validator.md; file_write and shell access exceed the principle of least privilege for development guidance tools.

Details

Findings

Low

No MCP servers are defined in the profile; MCP integration is documented as a skill (mcp-integration) but no actual MCP server configurations are present in the untrusted content.
Profile is a development toolkit, not an MCP consumer; no hidden instructions in tool descriptions, no arbitrary binary execution, no unrestricted network/filesystem access via MCP.

Details

Evidence

MCP servers section: (none)—no MCP server definitions provided.
mcp-integration skill is mentioned in README as guidance for users to integrate MCP into their own plugins, not a malicious MCP server embedded in this profile.