Security risk report for @forgecat/anthropics_skills_theme-factory v0.0.6
Source Integrity
Low
Profile is attributed to Anthropic with a public GitHub repository (anthropics/skills) and a specific commit hash, enabling verification.
Licensed under Apache-2.0, a well-known open-source license; no supply-chain red flags detected.
Agent Intent
Low
Content describes a legitimate styling toolkit with no instructions to manipulate the AI, read credentials, exfiltrate data, or hide instructions.
Usage instructions are straightforward: display a theme showcase, ask for user selection, and apply chosen theme—no prompt injection, role hijacking, or guidance poisoning.
Theme definitions contain only color hex codes and font names; no malicious knowledge, typosquatted packages, or security-weakening directives are embedded.
Details
Evidence
Usage Instructions section: 'Show the theme showcase', 'Ask for their choice', 'Apply the theme'—all benign procedural steps.
Theme files (e.g., arctic-frost.md) contain only color palettes and typography specifications with no hidden instructions.
Permissions
Low
No tools or MCP servers are declared; the profile is purely instructional markdown describing a styling workflow.
The skill requests only file-reading (theme showcase PDF, theme definition files) and artifact modification (applying colors/fonts)—both aligned with the stated purpose of styling artifacts.
No shell, file deletion, network access, or excessive agency is requested.
Details
Evidence
Declared tools section is empty; no high-risk or medium-risk tool categories are invoked.
SKILL.md references only `{{ref:theme-factory-assets}}/theme-showcase.pdf` and `themes/` directory reads—scoped, read-only access.
MCP Risk
Low
No MCP servers are defined in the profile; the skill operates entirely through markdown instructions and local theme files.
No external host access, arbitrary binary execution, or unrestricted network/filesystem permissions are configured.
Details
Evidence
MCP servers section is empty.
All theme data is self-contained in markdown files with static color and font definitions.
ForgeCat