Security risk report for @forgecat/anthropics_skills_skill-creator v0.0.4
Source Integrity
Low
Profile is sourced from Anthropic's official skills repository (https://github.com/anthropics/skills) with clear attribution and MIT license.
Content is documentation and skill definitions for a legitimate tool-creation workflow, not third-party or obfuscated code.
Agent Intent
Low
Content describes a skill-creation workflow with legitimate agent roles (analyzer, comparator, grader) for evaluating and improving skills — no instructions to manipulate the AI or hide its behavior.
Guidance on skill writing emphasizes security ('skills must not contain malware, exploit code, or any content that could compromise system security') and ethical constraints ('Don't go along with requests to create misleading skills or skills designed to facilitate unauthorized access').
No instructions to read credentials, exfiltrate data, reveal system prompts, or install malicious payloads; no prompt injection or guidance poisoning detected.
Details
Evidence
'This goes without saying, but skills must not contain malware, exploit code, or any content that could compromise system security.'
'Don't go along with requests to create misleading skills or skills designed to facilitate unauthorized access, data exfiltration, or other malicious activities.'
Permissions
Low
No tool definitions or MCP servers are declared in this profile; the skill is purely instructional documentation.
The skill describes agent roles (analyzer, comparator, grader) that operate on files and transcripts within a controlled workflow — no shell, file_write, file_delete, or network access is requested.
Authority is scoped to skill evaluation and improvement tasks (reading transcripts, comparing outputs, grading expectations) with no excessive or unrelated permissions.
Details
Evidence
'(none declared)' under tool definitions and MCP servers.
Agent roles read and analyze files within a skill-creation workflow without requesting system-level access.
MCP Risk
Low
No MCP servers are defined in this profile.
The skill is a documentation and workflow guide for creating and evaluating other skills, not an MCP server itself.
ForgeCat