Security risk report for @forgecat/anthropics_skills_brand-guidelines v0.0.7
Source Integrity
Low
Profile references official Anthropic repository (github.com/anthropics/skills) with specific commit hash, indicating legitimate upstream source.
Apache-2.0 license and documented authorship support supply chain transparency.
Agent Intent
Low
Content is purely descriptive documentation of brand styling (colors, fonts, typography) with no instructions to manipulate the AI, read credentials, or exfiltrate data.
No prompt injection, role hijacking, system prompt leakage, or guidance poisoning detected; the skill simply applies visual formatting standards.
No instructions to fetch external URLs, install malicious dependencies, or weaken security defaults.
Details
Evidence
Entire SKILL.md is a static reference guide listing hex color codes and font names (Poppins, Lora, Arial, Georgia).
README describes the skill's purpose as applying 'brand colors and typography to artifacts' — a cosmetic/styling function only.
Permissions
Low
No tools or hooks declared; the profile contains only documentation and brand reference data.
No file write, shell, network, or subagent permissions requested or implied.
Authority scope is minimal and matches stated function (visual styling guidance).
Details
Evidence
Declared tools section is empty: '(none declared)'.
No MCP servers or tool configurations present.
MCP Risk
Low
No MCP servers defined in the profile.
No binary execution, network access, or filesystem operations configured.
ForgeCat