heating the forge...

@forgecat/dietrichgebert_ponytail — Security Risk Report | ForgeCat

dietrichgebert_ponytail

Security risk report for @forgecat/dietrichgebert_ponytail v0.1.7

Low

Static scanner assigned low-level source risk; profile is published on GitHub (DietrichGebert/ponytail) with MIT license and documented installation flow.
README and AGENTS.md cite the original repository and commit hash, providing traceability; no evidence of typosquatted or attacker-controlled package names in the documented dependencies.
Installation instructions reference legitimate package managers (npx, npm, Codex, Gemini CLI) and standard platforms (Claude Code, Cursor, Codex); no hidden or obfuscated dependency injection detected.

Low

Profile content describes a code-minimization philosophy (YAGNI, stdlib-first, native-first) and does not instruct the AI to ignore system prompts, read credentials, exfiltrate data, or install remote payloads.
Skill definitions (ponytail, ponytail-review, ponytail-audit, ponytail-debt, ponytail-help) are legitimate code-review and guidance rules; they do not contain prompt injection, system prompt leakage, or guidance poisoning.
The 'ponytail:' comment convention is a documentation pattern for marking deliberate simplifications with upgrade paths—a transparency mechanism, not a hidden instruction or backdoor.

Details

Findings

Evidence

AGENTS.md: 'Mark intentional simplifications with a `ponytail:` comment. If the shortcut has a known ceiling (global lock, O(n²) scan, naive heuristic), the comment names the ceiling and the upgrade path.'
ponytail/SKILL.md: 'Lazy code without its check is unfinished. Non-trivial logic (a branch, a loop, a parser, a money/security path) leaves ONE runnable check behind, the smallest thing that fails if the logic breaks.'
No instructions to bypass security, disable validation, weaken defaults, or reuse malicious knowledge in future outputs.

PRM-003Medium

Two lifecycle hook scripts (ponytail-activate.js, ponytail-mode-tracker.js) are referenced but their full content is not visible; hooks that execute at session start/mode-change could carry broader permissions than the stated purpose of enforcing coding style.
The static scanner flagged both hooks under permissions/hook-no-tool-match, indicating they are not matched to declared tools — this is a mismatch between declared authority and actual execution scope.
The profile's stated purpose (coding style enforcement) does not inherently require lifecycle hooks with filesystem or shell access, making the hook presence slightly excessive relative to the description.

Details

Findings

Evidence

Low

Profile declares no MCP servers; the only external dependency mentioned is Node.js for lifecycle hooks, which is a standard runtime, not an MCP server.
README lists supported platforms (Claude Code, Cursor, Codex, Gemini, Pi, OpenCode) but does not define custom MCP server configurations or arbitrary binary execution.
No evidence of hidden instructions in tool descriptions, unrestricted network access, or full filesystem permissions in the declared content.

Details

Evidence

Profile field 'MCP servers (untrusted data): (none)'.
README: 'Dependencies: Node.js for Ponytail lifecycle hook scripts.' — standard runtime, not MCP.
Skills are markdown-based guidance rules, not MCP tool definitions.