Security risk report for @forgecat/anthropics_knowledge-work-plugins_enterprise-search v0.0.10
Source Integrity
Low
Profile is authored by Anthropic and sourced from the official anthropics/knowledge-work-plugins repository on GitHub.
Version tracking (0.0.10, commit d2ba7f6) and Apache-2.0 license provide transparency and auditability.
MCP server URLs point to legitimate, well-known SaaS platforms (Slack, Notion, Atlassian, Asana, Microsoft 365, Google, Guru) with no typosquatting or attacker-controlled domains.
Agent Intent
Low
Content describes legitimate enterprise search workflows (decomposing queries, ranking results, synthesizing information) with no instructions to ignore system prompts, exfiltrate data, or manipulate the agent.
Placeholder syntax (~~chat, ~~email, ~~cloud storage) is documented as a tool-agnostic design pattern for dynamic source resolution—not an obfuscation or injection vector.
Skill instructions (search, digest, knowledge-synthesis, search-strategy, source-management) are procedural guidance for multi-source querying and result synthesis; they do not plant malicious knowledge, weaken security defaults, or steer outputs toward attacker goals.
Details
Evidence
CONNECTORS.md: 'Plugins are tool-agnostic — they describe workflows in terms of categories (chat, email, cloud storage, etc.) rather than specific products.'
search/SKILL.md: 'Synthesize results into answers, do not just list raw search results' — standard UX guidance, not poisoning.
knowledge-synthesis/SKILL.md: 'Always surface conflicts rather than silently picking one version' — promotes transparency, not deception.
Permissions
Low
MCP servers are read-only query and retrieval operations (search messages, read documents, fetch task metadata) aligned with the stated enterprise search purpose.
No file_write, file_delete, file_mutate, or shell execution permissions are declared or implied.
Digest and search skills operate within the scope of aggregating and synthesizing existing data; they do not request write access to sources or the ability to modify user data.
Details
Evidence
README.md: 'Search across all of your company's tools in one query' and 'Generate a daily or weekly digest' — both read-only operations.
search/SKILL.md: 'Execute the translated query' and 'Capture results with metadata' — retrieval only.
No alwaysApply rules or glob patterns that would grant blanket authority.
MCP Risk
Low
All MCP servers are HTTP endpoints hosted by legitimate, well-known vendors (Slack, Notion, Atlassian, Asana, Microsoft, Google, Guru) with established security practices.
No arbitrary binary execution, shell commands, or unrestricted filesystem access is configured.
Tool descriptions in skill files (search, digest, synthesis) are procedural and do not contain hidden instructions or malicious payloads.
Details
Evidence
MCP server URLs: https://mcp.slack.com/mcp, https://mcp.notion.com/mcp, https://mcp.atlassian.com/v1/mcp, etc. — all standard, public endpoints.
No local binary execution, no file:// URLs, no shell= parameters.
Skill instructions focus on query decomposition and result ranking—standard information retrieval patterns.
ForgeCat