Security risk report for @forgecat/anthropics_knowledge-work-plugins_product-management v0.0.9
Source Integrity
Low
Profile is authored by Anthropic and sourced from the official knowledge-work-plugins repository on GitHub.
License is Apache-2.0 and source is publicly documented with commit hash and repository link.
Agent Intent
Low
Content describes legitimate product management workflows (spec writing, roadmap planning, research synthesis, metrics review) with no instructions to manipulate the AI, exfiltrate data, or bypass security controls.
Brainstorming and planning skills use standard PM frameworks (RICE, HMW, JTBD, SCAMPER) and encourage critical thinking — no guidance poisoning or hidden malicious directives.
Tool references use transparent placeholder syntax (~~category) documented in CONNECTORS.md; no obfuscation or injection attempts.
Details
Evidence
'Brainstorm a product topic with a sharp, opinionated thinking partner. This is a conversation, not a deliverable.'
'Use frameworks as thinking tools, not templates to fill in. Pull in a framework when it helps move the conversation forward.'
CONNECTORS.md explicitly explains how placeholders work: 'Plugins are tool-agnostic — they describe workflows in terms of categories rather than specific products.'
Permissions
Low
Skills request read-only access to connected tools (project tracker, analytics, knowledge base, chat, calendar) to pull context for planning and analysis.
No file_write, file_delete, or shell execution permissions requested; all operations are informational (pull data, synthesize, generate documents).
Authority is narrowly scoped to product management workflows and matches the stated purpose of the profile.
Details
Evidence
'If ~~project tracker is connected: Pull current roadmap items with their statuses, assignees, and dates.'
'If ~~product analytics is connected: Pull key product metrics for the relevant time period.'
No mention of alwaysApply rules, globs='**', or high-risk tool categories.
MCP Risk
MCP-000Medium
All 16 MCP servers use HTTPS endpoints at the canonical domains of well-known SaaS vendors (slack.com, linear.app, figma.com, etc.), with no unknown or arbitrary binaries involved.
No hidden instructions were found in tool descriptions, and no unrestricted filesystem or shell access is configured.
The sheer number of external host connections (16 servers) and the inclusion of Gmail — which can expose sensitive personal and business communications — elevates risk modestly above low despite each individual server being a recognized service.
Details
Evidence
mcp.json: 'pendo': {'url': 'https://app.pendo.io/mcp/v0/shttp'} — legitimate Pendo endpoint, slightly non-standard path but on the official domain.
mcp.json: 'gmail': {'url': 'https://gmail.mcp.claude.com/mcp'} — grants access to email content.
16 total MCP server entries spanning analytics, communications, design, and project management.
ForgeCat