heating the forge...

@forgecat/anthropics_knowledge-work-plugins_sales — Security Risk Report | ForgeCat

anthropics_knowledge-work-plugins_sales

Security risk report for @forgecat/anthropics_knowledge-work-plugins_sales v0.0.8

Low

Profile sourced from Anthropic's public knowledge-work-plugins repository (GitHub).
Licensed under Apache-2.0, version 0.0.8 with clear attribution and commit hash.
Legitimate, well-known vendor with established reputation; no supply-chain red flags.

Low

Content describes legitimate sales workflows (research, call prep, outreach, forecasting) with no instructions to manipulate the AI, ignore system prompts, or exfiltrate data.
Skill descriptions are transparent about what they do and how they work; no hidden directives or role-hijacking language.
References to external tools (CRM, email, calendar) are presented as optional connectors to enhance functionality, not as instructions to bypass security or access unauthorized resources.

Details

Findings

Evidence

'Works standalone with web search, supercharged when you connect enrichment tools or your CRM' — describes optional integrations, not coercive instructions.
'No connectors? No problem. Web search provides solid research for any company or person.' — acknowledges standalone operation without pressure to connect external systems.
All skill execution flows are transparent and user-centric; no hidden instructions to the AI to perform unauthorized actions.

Low

Skills request only web_search and web_fetch (standard, low-risk categories) for research and data enrichment.
Optional MCP server connections (CRM, email, calendar, chat) are user-initiated and scoped to their stated purpose (e.g., HubSpot for pipeline data, Gmail for email context).
No shell, file_write, file_delete, or other high-risk operations; asset generation outputs HTML artifacts (safe, read-only deliverables).

Details

Evidence

'Works standalone with web search' — primary mechanism is public web search, not privileged access.
MCP servers listed are industry-standard integrations (Slack, HubSpot, Salesforce, Notion, etc.) with clear, bounded purposes.
Asset creation outputs self-contained HTML files for sharing; no file mutation or system-level operations requested.

MCP-000Medium

All 14 MCP servers use HTTP transport to well-known, named vendor domains (slack.com, hubspot.com, clay.com, zoominfo.com, etc.) — no unknown binaries or arbitrary execution.
Several servers (Clay, ZoomInfo, Apollo) are data-enrichment platforms with access to contact PII (emails, phone numbers, org charts), which represents meaningful data-access risk if any server is compromised or misconfigured.
No hidden instructions were found in tool descriptions, and no unrestricted filesystem or network access is declared; risk is moderate due to the volume of external SaaS integrations rather than any specific malicious pattern.

Details

Evidence

"clay": {"type": "http", "url": "https://api.clay.com/v3/mcp"} — enrichment platform with PII access
"zoominfo": {"type": "http", "url": "https://mcp.zoominfo.com/mcp"} and "apollo": {"type": "http", "url": "https://api.apollo.io/mcp"} — contact database access
14 distinct external HTTP MCP endpoints; all point to recognizable vendor domains with no obfuscated or localhost/arbitrary URLs