Security risk report for @forgecat/anthropics_knowledge-work-plugins_design v0.0.10
Source Integrity
Low
Profile sourced from Anthropic's official knowledge-work-plugins repository (GitHub: anthropics/knowledge-work-plugins).
Licensed under Apache-2.0; original commit d2ba7f6 is traceable and verifiable.
Author is Anthropic; no third-party or untrusted supply chain indicators.
Agent Intent
Low
Content describes legitimate design and UX workflows (critique, accessibility audits, handoff specs, research synthesis) with no instructions to manipulate the AI, read credentials, or exfiltrate data.
Placeholder syntax (`~~design tool`, `~~project tracker`) is transparent documentation of tool-agnostic connectors—not hidden instructions or prompt injection.
No guidance poisoning: recommendations to use Figma, Slack, Linear, Notion, etc. are well-known, legitimate tools; no typosquatted packages, backdoored templates, or security-weakening directives.
No system prompt leakage, role hijacking, or instructions to hide/deny the profile's own content.
Details
Findings
Invisible characters detected
skills/design-system/SKILL.md · SKILL-011
Evidence
CONNECTORS.md explicitly documents placeholder semantics: 'Plugins are tool-agnostic — they describe workflows in terms of categories (design tool, project tracker, user feedback, etc.) rather than specific products.'
All skills (design-critique, accessibility-review, design-handoff, design-system, ux-copy, user-research, research-synthesis) describe standard design and UX practices with no malicious directives.
MCP server list includes only public, mainstream SaaS platforms (Slack, Figma, Linear, Asana, Atlassian, Notion, Intercom, Google Calendar, Gmail).
Permissions
Low
No explicit tool declarations or high-risk categories (shell, file_write, file_delete) in the profile.
MCP servers are read-only or standard integrations (Figma design inspection, Slack messaging, Linear ticket creation) aligned with stated design workflow purposes.
Authority is scoped to design collaboration, feedback, and documentation—no excessive agency or unrestricted filesystem/network access.
Details
Evidence
Skills reference connectors for legitimate design workflows: 'If ~~design tool is connected: Pull the design directly from Figma and inspect components, tokens, and layers.'
Project tracker integration is limited to creating accessibility or handoff tickets, not arbitrary system operations.
No alwaysApply rules, glob patterns, or blanket permissions detected.
MCP Risk
Low
All MCP servers are public, well-known SaaS platforms with standard HTTP endpoints; no unknown binaries or arbitrary code execution.
Server URLs are consistent with official Anthropic/platform documentation (e.g., mcp.slack.com, mcp.figma.com, gcal.mcp.claude.com).
No hidden instructions in tool descriptions; MCP server definitions are minimal and transparent.
Details
Evidence
MCP servers declared: Slack, Figma, Linear, Asana, Atlassian, Notion, Intercom, Google Calendar, Gmail—all mainstream, publicly documented platforms.
Transport type is 'http' for all servers; no local binary execution or unrestricted filesystem access.
No environment variable requirements or credential injection patterns in the MCP configuration.
ForgeCat