Security risk report for @forgecat/anthropics_knowledge-work-plugins_marketing v0.0.10
Source Integrity
Low
Profile is sourced from Anthropic's official knowledge-work-plugins repository (GitHub: anthropics/knowledge-work-plugins).
Licensed under Apache-2.0 and marked as authored by Anthropic, a trusted first-party source.
Agent Intent
Low
Content describes legitimate marketing workflows (content drafting, campaign planning, competitive analysis, reporting) with no instructions to manipulate the AI, ignore system instructions, or exfiltrate data.
Skill descriptions use standard placeholder syntax (`~~category`) for tool references, which is a documented design pattern for tool-agnostic profiles — not an attempt to inject hidden instructions.
No guidance poisoning detected; recommendations to use standard marketing platforms (HubSpot, Figma, Notion, Ahrefs) and well-known best practices are legitimate, not attacker-serving.
Details
Evidence
CONNECTORS.md explains placeholder syntax as a documented feature: 'Plugins are tool-agnostic — they describe workflows in terms of categories'.
Skills contain standard marketing frameworks (SMART objectives, messaging matrices, content templates) aligned with industry best practices.
No instructions to read credentials, disable security controls, or transmit data to external hosts.
Permissions
Low
Skills are read-only guidance and content generation; no file_write, file_delete, or shell execution requested.
MCP servers are external integrations (Slack, HubSpot, Amplitude, etc.) that the user explicitly connects; the profile does not demand authority beyond what is needed for marketing workflows.
Authority is scoped to marketing-specific operations: drafting content, analyzing performance, researching competitors — all aligned with the stated profile purpose.
Details
Evidence
Skills invoke external tools via placeholders (~~chat, ~~marketing automation, ~~analytics) but do not request alwaysApply rules or glob-based file access.
MCP server definitions are standard HTTP endpoints for known SaaS platforms; no unrestricted filesystem or shell access declared.
No rules or hooks with excessive scope detected.
MCP Risk
Low
All 13 MCP servers are well-known, legitimate SaaS platforms (Slack, Figma, HubSpot, Notion, Ahrefs, Klaviyo, etc.) with public APIs.
Servers are accessed via standard HTTP transport to official vendor endpoints; no arbitrary binary execution or hidden instructions in tool descriptions.
Scope is appropriate: each server provides access only to its own platform (e.g., Slack MCP connects to Slack workspace, Notion MCP to Notion workspace).
Details
Evidence
MCP URLs are official vendor domains (mcp.slack.com, mcp.figma.com, mcp.hubspot.com, mcp.notion.com, etc.) or Anthropic-hosted (gcal.mcp.claude.com, gmail.mcp.claude.com).
No environment variables or credentials embedded in server definitions; authentication is delegated to the user's local setup.
Tool descriptions in skills are standard marketing guidance with no hidden payloads or malicious instructions.
ForgeCat