Security risk report for @forgecat/anthropics_knowledge-work-plugins_operations v0.0.10
Source Integrity
Low
Profile sourced from Anthropic's official knowledge-work-plugins repository (https://github.com/anthropics/knowledge-work-plugins/tree/main/operations).
Licensed under Apache-2.0; version 0.0.10 with documented commit hash (d2ba7f6).
Declared author is Anthropic; no typosquatted or suspicious package dependencies listed.
Agent Intent
Low
Content describes legitimate business operations skills (process documentation, capacity planning, compliance tracking, vendor review, etc.) with no instructions to ignore system prompts, read credentials, or exfiltrate data.
Skill definitions use standard placeholder syntax (~~category) for tool-agnostic connectors; no hidden instructions or role-hijacking language detected.
No guidance poisoning: recommendations to use Slack, Notion, Asana, ServiceNow, etc. are well-known, legitimate tools; no typosquatted or attacker-controlled packages injected.
Markdown content is descriptive documentation of workflows and output templates, not imperative instructions to manipulate the AI or weaken security controls.
Details
Evidence
CONNECTORS.md: 'Plugins are tool-agnostic — they describe workflows in terms of categories (ITSM, project tracker, knowledge base, etc.) rather than specific products.'
Skills uniformly document legitimate business processes (e.g., 'Create a change management request with impact analysis and rollback plan').
No references to reading ~/.ssh, ~/.aws, .env, or exfiltrating environment variables.
No instructions to disable TLS, log credentials, or install remote payloads.
Permissions
PRM-000Medium
MCP servers grant access to multiple external platforms (Slack, Gmail, Notion, Asana, ServiceNow, Atlassian, Google Calendar, Microsoft 365) — broad connectivity for read/write operations across communication, project management, and knowledge systems.
Skills reference conditional tool use (e.g., 'If ~~project tracker is connected, pull current workload automatically'; 'If ~~ITSM is connected, create the change request ticket automatically') — authority is somewhat broader than a single stated function, though each skill's purpose is clearly defined.
No shell, file_write, file_delete, or unrestricted filesystem access declared; no alwaysApply=true rules with glob='**' patterns.
Authority is proportionate to stated business operations use case (vendor review, capacity planning, compliance tracking) but spans multiple external systems.
Details
Evidence
MCP servers list: Slack, Google Calendar, Gmail, Notion, Atlassian, Asana, ServiceNow, Microsoft 365 — all HTTP-based integrations.
capacity-plan skill: 'If ~~project tracker is connected: Pull current workload and ticket assignments automatically.'
change-request skill: 'If ~~ITSM is connected: Create the change request ticket automatically.'
MCP Risk
MCP-000Medium
MCP servers are HTTP-based endpoints to well-known SaaS platforms (Slack, Google, Atlassian, Asana, ServiceNow, Microsoft); no arbitrary binary execution or unknown servers.
URLs are public, documented endpoints (mcp.slack.com, gcal.mcp.claude.com, mcp.notion.com, etc.) — not suspicious or obfuscated.
No hidden instructions in tool descriptions; skill definitions are transparent and describe legitimate business workflows.
Potential risk: multiple external platform integrations create a broad attack surface if any MCP server is compromised or misconfigured; no explicit scope restrictions (e.g., read-only vs. read-write) documented per server.
ForgeCat