Security risk report for @forgecat/ayghri_i-have-adhd v0.1.3
Source Integrity
Low
Profile references a legitimate public GitHub repository (ayghri/i-have-adhd) with MIT license and verifiable commit hash.
No typosquatted, obfuscated, or attacker-controlled package dependencies declared; no external binary execution requested.
Agent Intent
Low
Content describes a legitimate output-formatting skill designed to improve readability for ADHD-friendly communication; no prompt injection, role hijack, or system prompt leakage attempts.
The skill instructs the agent to apply specific formatting rules (action-first, numbered steps, no preamble) to its own outputs—a stylistic transformation, not a manipulation of the agent's core instructions or hidden knowledge.
No guidance poisoning: the rules do not weaken security defaults, inject malicious code templates, or steer the agent toward attacker goals; they are transparent formatting preferences.
Details
Evidence
Rule 1: 'Lead with the next action' — formatting instruction, not a hidden directive.
Rule 10: 'No preamble, no recap, no closing pleasantries' — style guidance, not system prompt leakage.
No instructions to read ~/.ssh, ~/.aws, .env, or exfiltrate data.
Permissions
Low
No tools or skills are declared in the profile; the skill is purely an output-formatting instruction set applied to the agent's own responses.
No file system access, shell execution, network requests, or subagent invocation is requested or implied by the formatting rules.
Details
Evidence
Declared tools section: (none declared).
MCP servers section: (none).
The skill modifies how the agent structures its replies, not what authority it exercises.
MCP Risk
Low
No MCP servers are defined in the profile.
No binary execution, network access, or filesystem operations are configured.
ForgeCat