Security risk report for @forgecat/anthropics_knowledge-work-plugins_customer-support v0.0.11
Source Integrity
Low
Profile is sourced from Anthropic's official knowledge-work-plugins repository (GitHub: anthropics/knowledge-work-plugins), a trusted first-party source.
Licensed under Apache-2.0 with clear attribution and commit hash (d2ba7f6) for reproducibility.
No supply-chain red flags: dependencies are legitimate, well-known MCP servers (Slack, Intercom, HubSpot, Notion, Atlassian, Microsoft 365, Google Calendar, Guru).
Agent Intent
Low
Content describes legitimate customer support workflows (triage, research, response drafting, escalation, KB authoring) with no instructions to manipulate the AI, ignore system prompts, or exfiltrate data.
Placeholder syntax (~~support platform, ~~CRM, etc.) is transparent tool-agnostic design, not hidden instructions or prompt injection.
Guidance on research, communication, and escalation follows standard business practices; no malicious knowledge poisoning, typosquatted dependencies, or security-weakening directives detected.
Details
Evidence
CONNECTORS.md: 'Plugins are tool-agnostic — they describe workflows in terms of categories (support platform, CRM, chat, etc.) rather than specific products.'
customer-research/SKILL.md: 'Search systematically through the source tiers below, adapting to what is connected. Don't stop at the first result — cross-reference across sources.' (standard research practice)
draft-response/SKILL.md: 'Core Principles: Lead with empathy, Be direct, Be honest, Never overpromise, never mislead, never hide bad news in jargon.' (ethical communication guidance)
Permissions
PRM-000Medium
The profile connects nine external MCP servers spanning email (Gmail, Microsoft 365), calendar, CRM, chat, support platform, knowledge base, and project tracker — a broad surface area relative to a customer-support co-pilot.
Access to Gmail and Microsoft 365 grants read/write over potentially sensitive corporate communications, which is broader than strictly necessary for ticket triage and response drafting.
No shell, file_write, or file_delete tool categories are declared; the authority is wide in scope but confined to SaaS APIs, keeping risk at medium rather than high.
README.md MCP table lists 9 servers including Google Calendar, Gmail, Microsoft 365, HubSpot, Slack, Intercom, Guru, Atlassian, Notion.
MCP Risk
Low
All MCP servers are from known, legitimate vendors (Slack, Intercom, HubSpot, Notion, Atlassian, Microsoft, Google, Guru) with established security practices and public APIs.
No hidden instructions in tool descriptions; MCP URLs are standard public endpoints (https://mcp.slack.com/mcp, https://mcp.intercom.com/mcp, etc.) with no obfuscation.
No arbitrary binary execution, unrestricted network access, or full filesystem permissions; access is mediated through vendor-provided MCP servers with standard OAuth/API authentication.
Details
Evidence
.mcp.json: All 9 servers use 'type: http' with public HTTPS URLs to known vendors (Slack, Intercom, HubSpot, Guru, Atlassian, Notion, Microsoft 365, Google Calendar, Gmail).
ForgeCat