heating the forge...

@forgecat/anthropics_skills_pptx — Security Risk Report | ForgeCat

anthropics_skills_pptx

Security risk report for @forgecat/anthropics_skills_pptx v0.0.4

Low

Profile claims authorship by Anthropic with reference to https://github.com/anthropics/skills and commit hash 5128e18.
Content is legitimate PPTX manipulation guidance (python-pptx, PptxGenJS, markitdown, LibreOffice tools) with no typosquatted or attacker-controlled dependencies.
Static scanner confirms safe classification; no supply-chain red flags detected.

Low

Content is purely instructional documentation for PPTX file operations (reading, editing, creating presentations) with no hidden directives to manipulate the AI agent.
No instructions to ignore system prompts, read credentials, exfiltrate data, install remote payloads, or reveal system instructions.
Design guidance (color palettes, typography, layout patterns) and technical tutorials (XML editing, script usage, QA workflows) are legitimate skill documentation, not poisoned guidance steering toward attacker goals.
References to subagents and tool usage are appropriate delegation patterns, not self-expanding authority or role hijacking.

Details

Findings

Evidence

README.md: 'Use this skill any time a .pptx file is involved in any way' — scope-limited trigger, no manipulation language.
SKILL.md QA section: 'USE SUBAGENTS — even for 2-3 slides. You've been staring at the code and will see what you expect, not what's there.' — healthy delegation, not instruction to hide or deny.
editing.md: 'Use the Edit tool, not sed or Python scripts' — tool recommendation for reliability, not security-weakening guidance.
pptxgenjs.md: Standard JavaScript library documentation with no injected malicious code templates or disabled security defaults.

Low

Profile declares no tools, hooks, or MCP servers — it is pure markdown documentation.
Guidance references legitimate, scoped utilities (python-pptx, PptxGenJS, markitdown, LibreOffice soffice, pdftoppm) for PPTX manipulation only.
No file_write, file_delete, shell, or high-risk categories are invoked; no alwaysApply rules or glob patterns requesting excessive authority.

Details

Evidence

Profile metadata: 'Dependencies: None' — no tool installation or permission escalation.
SKILL.md scripts section: All commands are read-only (markitdown, thumbnail.py, unpack.py) or scoped to PPTX files (pack.py, clean.py).
No instructions to modify system files, install packages, or access unrelated directories.

Low

No MCP servers are defined in the profile.
No tool descriptions, binary execution, network access, or filesystem scope to evaluate.

Details

Evidence