Security risk report for @forgecat/anthropics_knowledge-work-plugins_productivity v0.0.10
Source Integrity
Low
Profile is sourced from Anthropic's official knowledge-work-plugins repository (github.com/anthropics/knowledge-work-plugins), a trusted first-party source.
Version pinning (0.0.10, commit d2ba7f6) and Apache-2.0 license indicate transparent, auditable provenance.
No supply-chain red flags: dependencies are optional and well-known (Slack, Notion, Asana, Linear, etc.).
Agent Intent
Low
Content describes legitimate productivity workflows (task management, memory encoding, dashboard UI) with no instructions to ignore system prompts, exfiltrate data, or manipulate the agent's behavior.
Memory system is designed to help Claude understand workplace shorthand, not to inject malicious guidance or weaken security defaults.
No evidence of prompt injection, role hijacking, credential harvesting, or guidance poisoning; the profile teaches Claude to decode user context, not to bypass controls or hide its instructions.
Details
Evidence
Memory-management skill: 'Two-tier memory system that makes Claude a true workplace collaborator. Decodes shorthand, acronyms, nicknames, and internal language so Claude understands requests like a colleague would.'
Start skill: 'Initialize the task and memory systems, then open the unified dashboard.' — straightforward setup, no hidden instructions.
Update skill: 'Keep your task list and memory current. Two modes: Default: Sync tasks from external tools, triage stale items, check memory for gaps; --comprehensive: Deep scan chat, email, calendar, docs' — normal operational guidance.
Permissions
PRM-000Medium
The skills instruct the agent to read and write local files (TASKS.md, CLAUDE.md, memory/ directory, dashboard.html), which constitutes file_write/file_mutate authority; this is broadly consistent with the stated productivity purpose but is non-trivial.
The update --comprehensive mode instructs scanning email, calendar, chat, and documents via multiple MCP connections simultaneously, representing a wide sweep of potentially sensitive personal data beyond a minimal task-management scope.
No shell execution or file deletion is instructed, and all write operations are scoped to well-defined local files, keeping the risk at medium rather than high.
Details
Evidence
skills/start/SKILL.md: 'Create TASKS.md... Copy it from {{ref:dashboard}} to the current working directory... create: memory/glossary.md, memory/people/{name}.md, memory/projects/{name}.md, memory/context/company.md'
skills/update/SKILL.md: 'Gather data from available MCP sources: Chat: Search recent messages... Email: Search sent messages... Documents: List recently touched docs... Calendar: List recent + upcoming events'
MCP Risk
MCP-000Medium
Ten external MCP servers are configured (Slack, Notion, Asana, Linear, Atlassian, Microsoft 365, Monday, ClickUp, Google Calendar, Gmail), all pointing to official vendor-hosted endpoints — no unknown or arbitrary binaries are involved.
The breadth of connected services (email, calendar, chat, documents, multiple project trackers) means a compromised or misbehaving MCP server could expose a wide surface of sensitive workplace data.
All server URLs use well-known vendor domains (mcp.slack.com, mcp.notion.com, microsoft365.mcp.claude.com, etc.) with no hidden instructions embedded in tool descriptions; risk is elevated by scope rather than by malicious configuration.
ForgeCat