Security risk report for @forgecat/anthropics_claude-plugins-official_pr-review-toolkit v0.0.4
Source Integrity
Low
Profile sourced from official Anthropic repository (claude-plugins-official), a trusted first-party source.
Metadata indicates Apache-2.0 license and clear attribution to original maintainers.
Agent Intent
Low
Content describes legitimate code review agents with standard software engineering practices (testing, error handling, type design, code quality).
No instructions to read credentials, exfiltrate data, ignore system prompts, or execute remote payloads.
No guidance poisoning: recommendations follow established best practices (ES modules, explicit returns, proper error handling) without deceptive or security-weakening directives.
Examples in code-simplifier and other agents show normal development workflows, not manipulation tactics.
Details
Evidence
code-reviewer: 'verify adherence to explicit project rules (typically in CLAUDE.md or equivalent)'
silent-failure-hunter: 'Never silently fail in production code. Always log errors using appropriate logging functions.'
type-design-analyzer: 'Prefer compile-time guarantees over runtime checks when feasible'
Permissions
Low
Agents are scoped to code review and analysis tasks (reading diffs, analyzing comments, checking tests, reviewing types).
Allowed tools in review-pr command are minimal and appropriate: Bash, Glob, Grep, Read, Task — used only for git operations and file inspection.
No file_write, file_delete, shell execution, or network access declared; agents operate on local git state only.
ForgeCat