Security risk report for @forgecat/anthropics_knowledge-work-plugins_data v0.0.9
Source Integrity
Low
Profile is sourced from Anthropic's official knowledge-work-plugins repository (GitHub: anthropics/knowledge-work-plugins).
Licensed under Apache-2.0; original commit and version tracked (d2ba7f6, v0.0.9).
Static scanner confirms low risk for supply chain compromise.
Agent Intent
Low
Content describes legitimate data analysis workflows (SQL querying, visualization, dashboard building) with no instructions to manipulate the AI or hide its instructions.
The data-context-extractor skill documents a meta-workflow for generating company-specific skills, but does not instruct the AI to ignore its system prompt, exfiltrate credentials, or install malicious payloads.
Reference templates and examples (e.g., domain-template.md, skill-template.md) are educational scaffolding for analysts to document their own data schemas—not poisoned guidance that would steer future outputs toward attacker goals.
Details
Evidence
CONNECTORS.md: 'Plugins are tool-agnostic — they describe workflows in terms of categories rather than specific products.'
data-context-extractor/SKILL.md: Describes bootstrap and iteration modes for extracting tribal knowledge and generating reference files—standard knowledge management, not manipulation.
skill-template.md and domain-template.md: Provide templates for analysts to fill in their own entity definitions, metrics, and query patterns—no hidden instructions or security-weakening guidance.
Permissions
Low
Skills declare use of tool placeholders (~~data warehouse, ~~notebook, ~~product analytics) that are resolved at runtime by the user's MCP configuration; no hardcoded high-risk tool demands.
Individual skills (analyze, build-dashboard, create-viz, etc.) request only data-read and visualization capabilities appropriate to their stated purpose.
No file_write, file_delete, shell, or other high-risk categories are invoked; dashboards are generated as self-contained HTML files without persistent mutations.
Details
Evidence
CONNECTORS.md: 'Plugins are tool-agnostic — they describe workflows in terms of categories (data warehouse, notebook, product analytics, etc.) rather than specific products.'
build-dashboard/SKILL.md: 'Save the dashboard as an HTML file with a descriptive name (e.g., sales_dashboard.html)' — local file creation only, no alwaysApply or glob-based authority.
No MCP server definitions include alwaysApply=true or unrestricted globs.
MCP Risk
MCP-000Medium
Six of eight MCP servers point to known, named external SaaS APIs (Google BigQuery, Atlassian, Hex, Amplitude, Definite) — these are recognizable vendors, reducing unknown-binary risk, but each represents an external network endpoint the agent can reach.
Snowflake and Databricks entries have empty URLs, meaning they are unconfigured placeholders that pose no immediate risk but could be populated with arbitrary endpoints by a user or downstream installer.
No hidden instructions were found in tool descriptions (none are declared), and no unrestricted filesystem or arbitrary binary execution is configured; risk is moderate due to breadth of external host access rather than any single high-severity indicator.
Details
Evidence
mcp.json: `"snowflake": {"type": "http", "url": ""}` and `"databricks": {"type": "http", "url": ""}` — blank URLs are unresolved placeholders
mcp.json: `"amplitude": {"url": "https://mcp.amplitude.com/mcp"}` and `"amplitude-eu": {"url": "https://mcp.eu.amplitude.com/mcp"}` — two separate Amplitude endpoints (US + EU) expand network surface
mcp.json: `"definite": {"url": "https://api.definite.app/v3/mcp/http"}` — lesser-known vendor compared to others; warrants user verification before enabling
ForgeCat