Security risk report for @forgecat/anthropics_knowledge-work-plugins_engineering v0.0.10
Source Integrity
Low
Profile is published by Anthropic (stated author) with clear attribution to the official knowledge-work-plugins repository on GitHub.
Version, commit hash, and license (Apache-2.0) are documented; source is traceable and legitimate.
Agent Intent
Low
Content describes legitimate engineering workflows (code review, incident response, system design, testing) with no instructions to manipulate the AI, ignore instructions, or exfiltrate data.
Skill descriptions use standard placeholders (~~source control, ~~monitoring) to reference tool categories; this is transparent connector abstraction, not hidden instruction injection.
No guidance poisoning: recommendations are for well-known, legitimate tools (GitHub, Slack, PagerDuty, Datadog) and standard practices (ADR format, testing pyramid, blameless postmortems).
Details
Evidence
All skills are functional engineering aids with clear, documented purposes.
Connector documentation explicitly explains placeholder mechanism: 'Plugins are tool-agnostic — they describe workflows in terms of categories rather than specific products.'
No instructions to read credentials, fetch external payloads, reveal system prompts, or weaken security defaults.
Permissions
Low
Skills are read-only or informational: they generate checklists, documentation templates, and analysis frameworks without requesting file write, shell execution, or deletion.
Tool integrations (source control, monitoring, chat, project tracker) are scoped to their stated purposes: pulling PR diffs, fetching logs, posting updates, searching tickets.
No alwaysApply rules or glob-based wildcards; authority is narrowly matched to each skill's function.
Details
Evidence
code-review: reads PR diffs and source code; no write or delete.
incident-response: reads monitoring data and creates status documents; no infrastructure mutation.
standup: reads recent commits and ticket status; no write.
deploy-checklist: generates a template; user manually executes deploy steps.
MCP Risk
MCP-000Medium
MCP servers are external HTTP endpoints (Slack, GitHub, Linear, Asana, Notion, PagerDuty, Datadog, Google Calendar, Gmail) requiring authentication and network access.
No hidden instructions in tool descriptions; server definitions are straightforward URL mappings.
Medium risk stems from broad external host access and reliance on multiple third-party services; if any MCP server is compromised or misconfigured, it could expose user data or allow unauthorized actions.
ForgeCat