Security risk report for @forgecat/anthropics_claude-plugins-official_skill-creator v0.0.5
Source Integrity
Low
Profile is sourced from Anthropic's official claude-plugins-official repository (https://github.com/anthropics/claude-plugins-official), a trusted first-party source.
Commit hash c447c3207a4 is traceable and verifiable; Apache-2.0 license is standard and transparent.
Agent Intent
Low
Content describes legitimate skill-creation workflows (writing SKILL.md, running evals, benchmarking, iterating) with no instructions to manipulate the AI, exfiltrate data, or bypass security controls.
Agent instructions (analyzer.md, comparator.md, grader.md) are procedural guidance for evaluating and improving skills — they do not instruct reading credentials, hiding instructions, or installing malicious payloads.
The 'Principle of Lack of Surprise' section explicitly warns against malware and unauthorized access, reinforcing security-conscious design.
Details
Evidence
README.md: 'Create new skills, modify and improve existing skills, and measure skill performance.'
SKILL.md: 'Your job when using this skill is to figure out where the user is in this process and then jump in and help them progress through these stages.'
SKILL.md: 'This goes without saying, but skills must not contain malware, exploit code, or any content that could compromise system security.'
Permissions
Low
No tool definitions or MCP servers are declared in this profile; the skill is purely instructional guidance for skill creation and evaluation workflows.
The profile does not request file system access, shell execution, network calls, or other high-risk permissions — it documents processes for users to follow manually or via their own tools.
Details
Evidence
Profile metadata: 'Dependencies: None required to install this profile.'
No 'tools' or 'mcp_servers' sections present in the profile structure.
MCP Risk
Low
No MCP servers are defined or referenced in this profile.
The profile contains only markdown documentation and procedural guidance; no binary execution, network access, or external service integration is configured.
Details
Evidence
Profile structure contains only README.md, SKILL.md, and agent guidance documents (analyzer.md, comparator.md, grader.md).
No 'mcp_servers' field present in profile metadata.
ForgeCat