Security risk report for @forgecat/anthropics_knowledge-work-plugins_finance v0.0.10
Source Integrity
Low
Profile is sourced from Anthropic's official knowledge-work-plugins repository (https://github.com/anthropics/knowledge-work-plugins/tree/main/finance), a trusted first-party source.
Version 0.0.10 with commit hash d2ba7f6 is traceable and verifiable; licensed under Apache-2.0.
No evidence of supply-chain tampering, typosquatted dependencies, or attacker-controlled package references in the markdown content.
Agent Intent
Low
Content describes legitimate finance and accounting workflows (journal entries, reconciliation, SOX testing, close management) with no instructions to manipulate the AI, ignore system prompts, or exfiltrate data.
Markdown files document standard accounting methodologies, control testing frameworks, and best practices; they educate rather than inject malicious guidance.
No evidence of guidance poisoning: the profile does not instruct the agent to weaken security defaults, install backdoored code, use typosquatted packages, or systematically steer outputs toward attacker goals.
Details
Evidence
README.md: 'Streamline finance and accounting workflows with Claude. Covers journal entries, account reconciliation, financial statement generation, variance analysis, SOX testing, month-end close management, and audit support.'
audit-support/SKILL.md: 'This skill assists with SOX compliance workflows but does not provide audit or legal advice. All testing workpapers and assessments should be reviewed by qualified financial professionals.'
No instructions to read ~/.ssh, ~/.aws, .env, or exfiltrate environment variables; no instructions to fetch external URLs or install remote payloads.
Permissions
Low
Profile declares no direct tool permissions (no shell, file_write, file_delete, or high-risk categories in the profile itself).
MCP servers are scoped to legitimate business functions: BigQuery (data warehouse read), Slack (messaging), Microsoft 365 (email/office), Google Calendar/Gmail (calendar/email access).
Authority matches stated purpose: finance and accounting workflows require read access to data warehouses and communication/office tools, which are appropriately configured.
Details
Evidence
No 'alwaysApply=true' rules with globs='**' or unrestricted file/shell access declared.
MCP servers are known, public endpoints (bigquery.googleapis.com, mcp.slack.com, microsoft365.mcp.claude.com) with scoped functionality.
Skills are user-invocable only where appropriate (journal-entry, reconciliation, financial-statements, variance-analysis, sox-testing are invocable; audit-support, close-management, journal-entry-prep are background/non-invocable).
MCP Risk
Low
MCP server definitions use known, public endpoints with no hidden instructions in tool descriptions; no arbitrary binary execution or unrestricted network/filesystem access.
Snowflake and Databricks URLs are empty (not yet configured), reducing attack surface; BigQuery, Slack, Microsoft 365, Google Calendar, and Gmail are first-party or well-known third-party services.
No evidence of malicious tool descriptions, obfuscated payloads, or environment variable exfiltration in MCP configurations.
Details
Evidence
MCP servers defined in .mcp.json: snowflake (empty URL), databricks (empty URL), bigquery (https://bigquery.googleapis.com/mcp), slack (https://mcp.slack.com/mcp), ms365 (https://microsoft365.mcp.claude.com/mcp), google-calendar, gmail.
No custom or unknown binaries; all servers are HTTP-based and point to known public services.
Tool descriptions in skills (journal-entry, reconciliation, financial-statements, etc.) are straightforward and document legitimate accounting workflows with no hidden instructions.
ForgeCat