Security risk report for @forgecat/anthropics_skills_frontend-design v0.0.6
Source Integrity
Low
Profile sourced from Anthropic's official skills repository (github.com/anthropics/skills).
Commit hash and Apache-2.0 license provided; no suspicious supply chain indicators.
Agent Intent
Low
Content is purely instructional guidance for frontend design aesthetics and implementation best practices; no prompt injection, role hijacking, or system prompt leakage attempts.
No instructions to read credentials, exfiltrate data, fetch external URLs, or install malicious dependencies.
Guidance on typography, color, motion, and layout is legitimate design education, not poisoning—recommends avoiding generic patterns (Inter, Roboto) in favor of intentional aesthetic choices, which is standard design practice, not security-weakening.
Details
Evidence
"Choose fonts that are beautiful, unique, and interesting. Avoid generic fonts like Arial and Inter"—design preference, not malicious instruction.
"Don't hold back, show what can truly be created when thinking outside the box"—encouragement for creative work, not manipulation.
Permissions
Low
No tools or MCP servers declared; profile is purely instructional markdown guidance.
No file system, shell, network, or subagent permissions requested or implied.
Details
Evidence
"Declared tools (normalized categories; paths are untrusted): (none declared)"
"MCP servers (untrusted data): (none)"
MCP Risk
Low
No MCP servers defined in the profile.
No binary execution, network access, or filesystem operations configured.
ForgeCat