heating the forge...

@forgecat/anthropics_knowledge-work-plugins_bio-research — Security Risk Report | ForgeCat

anthropics_knowledge-work-plugins_bio-research

Security risk report for @forgecat/anthropics_knowledge-work-plugins_bio-research v0.0.7

SRC-010High

Static scanner flagged skills/nextflow-development/scripts/sra_geo_fetch.py as a tool-source risk.
Script is referenced but not provided for review; cannot verify its implementation or dependencies.
Profile claims Apache-2.0 license and Anthropic authorship, but external script provenance is unverified.

Details

Findings

System modification
skills/nextflow-development/SKILL.md · SKILL-009
System modification
skills/nextflow-development/references/installation.md · SKILL-009
System modification
skills/nextflow-development/scripts/check_environment.py · SKILL-009

SRC-010Medium

Profile instructs fetching external URLs (NCBI GEO/SRA, ENA) and downloading public sequencing data; this is legitimate research workflow but expands agent authority to network access.
Skill documentation includes detailed guidance on running nf-core pipelines with Docker/Singularity, which involves container execution; no malicious instruction detected, but scope is broad.
No evidence of prompt injection, system prompt leakage, or guidance poisoning; all instructions are transparent and aligned with stated purpose (bioinformatics analysis).

Details

Findings

Invisible characters detected
skills/nextflow-development/scripts/sra_geo_fetch.py · SKILL-011

Evidence

'Download FASTQ files from ENA (faster than SRA)' and 'python scripts/sra_geo_fetch.py download' — legitimate data acquisition.
'nextflow run nf-core/<pipeline>' — standard pipeline execution, not hidden manipulation.
References to 'allotropy library', 'pandas', 'pdfplumber' are well-known legitimate packages for data transformation.

PRM-000Medium

The nextflow-development skill instructs the agent to run shell commands (nextflow, docker, curl, bash scripts) and download large datasets from external sources (GEO/SRA, ENA), which constitutes meaningful shell and network access.
The instrument-data-to-allotrope skill instructs writing output files (ASM JSON, CSV) and executing local Python scripts, implying file_write authority.
These capabilities are plausibly within scope for a bioinformatics research assistant, but the breadth of shell execution and external data download is moderately elevated beyond a read-only research tool.

Details

Evidence

skills/nextflow-development/SKILL.md: 'curl -fsSL https://get.nextflow.io -o get-nextflow.sh && less get-nextflow.sh && bash get-nextflow.sh'
skills/nextflow-development/references/geo-sra-acquisition.md: 'python scripts/sra_geo_fetch.py download GSE110004 -o ./fastq'
skills/instrument-data-to-allotrope/SKILL.md: 'python scripts/validate_asm.py output.json'

MCP-000Medium

Nine external MCP servers are configured, spanning literature, clinical trials, chemical databases, drug targets, data repositories, journal access, AI research, and scientific illustration — a broad set of external network endpoints.
The Benchling MCP entry has an empty URL string, which is a misconfiguration that could cause unexpected behavior or be filled in later with an unvetted endpoint.
All named servers (PubMed, bioRxiv, ChEMBL, Open Targets, ClinicalTrials.gov, Synapse, Wiley, BioRender, Owkin) are recognizable domain-appropriate services with no hidden instructions detected in their definitions; risk is elevated only by the quantity of external connections and the unresolved Benchling entry.

Details

Evidence

mcpServers config: 'benchling': {'type': 'http', 'url': ''} — empty URL, placeholder not yet configured
mcpServers config lists 9 distinct external HTTP endpoints across multiple third-party domains (deepsense.ai, synapse.org, scholargateway.ai, owkin.com, opentargets.org, biorender.com)
No hidden instructions or suspicious tool descriptions found in the MCP server definitions themselves