Security risk report for @forgecat/anthropics_knowledge-work-plugins_legal v0.0.10
Source Integrity
Low
Profile is authored by Anthropic and sourced from the official anthropics/knowledge-work-plugins repository on GitHub.
License is Apache-2.0; origin is clearly documented and verifiable.
Agent Intent
Low
Content describes legitimate legal workflows (contract review, compliance checks, NDA triage, risk assessment, briefings) without instructing the AI to ignore instructions, exfiltrate data, or manipulate its own behavior.
Guidance on using templates, playbooks, and escalation triggers is standard legal practice documentation, not poisoning.
No instructions to read credentials, fetch external payloads, reveal system prompts, or weaken security controls.
Details
Evidence
Skills are framed as assistive tools with explicit disclaimers: 'This command assists with legal workflows but does not provide legal advice.'
Escalation triggers and review checklists are designed to *increase* oversight, not bypass it (e.g., 'When an escalation trigger is detected: Stop. Do not generate a templated response.')
Permissions
PRM-000Medium
The profile connects to eight external MCP servers spanning email (Gmail), calendar (Google Calendar), chat (Slack), document storage (Box, Egnyte), project tracking (Atlassian), productivity suite (Microsoft 365), and e-signature (DocuSign) — a broad set of integrations.
Access to Gmail and Microsoft 365 in particular grants read/write authority over potentially sensitive legal communications and documents, which is broad but consistent with the stated legal workflow purpose.
No shell, file_write, file_delete, or file_mutate tool categories are declared; the authority, while wide in scope, is scoped to the described legal team use case and does not exceed it in an unexplained way.
Details
Evidence
MCP servers: slack, box, egnyte, atlassian, ms365, docusign, google-calendar, gmail — all declared in .mcp.json
Skills explicitly reference reading email, calendar, chat, CLM, CRM, and cloud storage as part of their workflows (e.g., brief/SKILL.md: 'Check each connected source for legal-relevant items')
MCP Risk
MCP-000Medium
MCP servers are external HTTP endpoints hosted by known vendors (Slack, Box, Egnyte, Atlassian, Microsoft, DocuSign, Google); no arbitrary binary execution or hidden instructions detected.
Servers provide legitimate integrations for legal workflows (document storage, email, calendar, e-signature) but collectively grant broad access to organizational data (contracts, emails, calendars, vendor agreements).
No scoping restrictions documented in the profile; an agent using all eight servers simultaneously would have extensive read/write access to sensitive business and legal information.
Details
Evidence
All MCP servers are HTTP-based and hosted by established vendors with public APIs.
No tool descriptions contain hidden instructions or suspicious language.
Collective access scope is broad: email (Gmail, Microsoft 365), calendar (Google Calendar, Microsoft 365), chat (Slack), documents (Box, Egnyte, Atlassian), e-signature (DocuSign).
ForgeCat