Security risk report for @forgecat/anthropics_claude-plugins-official_pr-review-toolkit v0.0.5
Source Integrity
Low
Profile sourced from official Anthropic repository (claude-plugins-official).
Metadata indicates Apache-2.0 license and legitimate origin.
Static scanner confirms low risk.
Agent Intent
Low
Content describes legitimate code review agents with no instructions to manipulate the AI or hide its instructions.
No prompt injection, system prompt leakage, or guidance poisoning detected.
Agent descriptions document proper use cases (PR review, code simplification, error analysis) without malicious steering.
Details
Evidence
All agent descriptions focus on code quality analysis: 'review code for adherence to project guidelines', 'analyze code comments for accuracy', 'identify silent failures'.
No instructions to read credentials, exfiltrate data, or execute remote payloads.
No directives to weaken security defaults or install backdoored dependencies.
Permissions
Low
Declared tools are limited to safe categories: Bash, Glob, Grep, Read, Task (for agent invocation).
No file_write, file_delete, or shell execution with unrestricted scope.
Tool usage is scoped to code review workflows (git diff, file reading, agent spawning).
ForgeCat