Security risk report for @forgecat/cursor_plugins_team-kit v0.0.11
Source Integrity
SRC-010Medium
Profile claims origin from `https://github.com/cursor/plugins` with commit `9c39b57` (2026-03-13), but the future date is implausible and cannot be independently verified.
Author field lists `Cursor` (the IDE vendor) without clear provenance chain; no cryptographic signature or checksum provided.
Medium risk: plausible internal-workflow profile, but the untrusted repository URL and impossible commit date warrant caution about authenticity.
Details
Findings
Suspicious URLs
skills/pr-review-canvas/SKILL.md · SKILL-007
Agent Intent
Low
Profile contains no instructions to ignore system prompts, read credentials, exfiltrate data, or install remote payloads.
Skills describe legitimate CI/CD, code review, and testing workflows using standard tools (git, gh CLI, npm, Playwright) with no hidden directives.
Guidance is straightforward and security-conscious (e.g., 'do not bypass hooks', 'keep changes minimal', 'prefer correctness over style').
Details
Evidence
All skills use transparent, well-documented workflows (e.g., 'Run compile and type-check commands', 'Resolve merge conflicts non-interactively').
No instructions to read ~/.ssh, ~/.aws, .env, or transmit data to external hosts.
Guardrails explicitly discourage risky practices: 'Do not bypass hooks (--no-verify)', 'Keep behavior unchanged unless fixing a clear bug'.
Permissions
PRM-000Medium
Several skills implicitly require shell execution (running `gh`, `git`, `npm`, `python3`, `bash`) and file write access (writing to /tmp, modifying source files) — these are medium-to-high risk categories even though no explicit tool declarations are made.
The pr-review-canvas skill writes files to /tmp and starts a local HTTP server, which is broader than a pure read-only code-review function, though it is scoped to localhost.
The loop-on-ci and fix-ci skills commit and push code changes autonomously in a loop, representing meaningful autonomous agency over the repository state beyond simple monitoring.
Details
Evidence
pr-review-canvas/SKILL.md: 'Start a local server on a fixed port: python3 -m http.server 8432 --bind 127.0.0.1'
loop-on-ci/SKILL.md: 'implement a focused fix, commit, and push. Repeat until all required checks pass.'
fix-ci/SKILL.md: 'Apply the smallest safe fix. Re-run CI and repeat until green.'
MCP Risk
Low
No MCP servers are declared in the profile.
All tool invocations are standard CLI commands (git, gh, npm, Python) with no arbitrary binary execution or hidden server definitions.
Skills operate within the repository filesystem and GitHub API (via gh CLI) with no unrestricted network or filesystem access.
Details
Evidence
Profile declares 'Dependencies: None' and no MCP server definitions.
All commands are transparent and use well-known, auditable tools.
Network access is limited to GitHub API calls via the `gh` CLI, which is user-authenticated and scoped to the repository.
ForgeCat