Security risk report for @forgecat/anthropics_knowledge-work-plugins_human-resources v0.0.10
Source Integrity
Low
Profile is authored by Anthropic and sourced from the official knowledge-work-plugins repository (https://github.com/anthropics/knowledge-work-plugins).
All MCP server URLs point to known Anthropic/official service domains (mcp.slack.com, gcal.mcp.claude.com, mcp.notion.com, etc.).
No typosquatted, obfuscated, or attacker-controlled package/service references detected.
Agent Intent
Low
Content describes legitimate HR workflows (recruiting, onboarding, performance reviews, compensation analysis) with no instructions to ignore system prompts, exfiltrate credentials, or manipulate the AI.
Skill definitions use standard placeholders (~~HRIS, ~~ATS, ~~calendar) to reference tool categories; this is transparent tool-agnostic design, not hidden instruction injection.
No guidance poisoning detected: recommendations for data sources (Workday, BambooHR, Notion, Slack) are well-known, legitimate platforms; no typosquatted or backdoored packages suggested.
Policy-lookup skill explicitly includes guardrails: 'cite the source document', 'if no policy found, say so clearly rather than guessing', 'recommend consulting HR or legal for edge cases'—these are security-conscious practices, not manipulation.
Details
Evidence
CONNECTORS.md: 'Plugins are tool-agnostic — they describe workflows in terms of categories (HRIS, ATS, email, etc.) rather than specific products.'
policy-lookup SKILL.md: 'Important guardrails: Always cite the source document and section. If no policy is found, say so clearly rather than guessing.'
No instructions to read ~/.ssh, ~/.aws, .env, or exfiltrate data to external hosts.
No instructions to hide, deny, or leak system prompts or tool definitions.
Permissions
PRM-000Medium
Six external MCP servers are connected (Slack, Google Calendar, Gmail, Notion, Atlassian, Microsoft 365), granting broad access to communication, calendar, email, and knowledge-base systems across an organization.
This breadth of access is somewhat wider than strictly necessary for any single HR workflow, though each connector is individually justified by a named skill (e.g., Gmail/calendar for onboarding scheduling, Slack for report sharing).
No shell, file_write, file_delete, or file_mutate tool categories are declared; the elevated concern is scope of external service access rather than local system authority.
people-report/SKILL.md: 'If ~~chat is connected: Offer to share the report summary in a relevant channel' — agent can post workforce analytics (including diversity/attrition data) to Slack channels.
onboarding/SKILL.md: 'If ~~calendar is connected: Create Day 1 calendar events and Week 1 meeting invites automatically' — agent can write to organizational calendars.
MCP Risk
MCP-000Medium
Six MCP servers are defined with HTTP transport to external URLs (Slack, Google Calendar, Gmail, Notion, Atlassian, Microsoft 365); these are known services but require network access and user authentication.
No hidden instructions or arbitrary binary execution detected in tool descriptions; all skill descriptions are transparent and document their intended function.
MCP server definitions do not specify required environment variables or credentials in the profile itself; authentication is delegated to the user's setup, which is appropriate.
Scope is not explicitly restricted (no glob patterns or conditional access rules in the profile), so a connected HRIS or ATS could theoretically expose all employee records if the user grants broad permissions.
ForgeCat