heating the forge...

egonex-ai_understand-anything

Security risk report for @forgecat/egonex-ai_understand-anything v0.1.0

SRC-010High

Static scanner flagged high-level source risk; profile references external GitHub repository (https://github.com/Egonex-AI/Understand-Anything) as the original source.
The profile is a repackaged third-party plugin with no ForgeCat-authored code visible in the markdown; dependency on external repository introduces supply-chain risk if that upstream source is compromised or untrusted.

Details

Findings

Suspicious URLs
skills/understand-dashboard/SKILL.md · SKILL-007
Suspicious URLs
skills/understand/packages/dashboard/vite.config.ts · SKILL-007
Suspicious URLs
skills/understand/packages/dashboard/vite.config.ts · SKILL-007
Credential-to-network dataflow
skills/understand/packages/dashboard/vite.config.ts · SKILL-010
Code obfuscation
skills/understand/packages/dashboard/src/utils/containers.ts · SKILL-005
Suspicious URLs
packages/dashboard/vite.config.ts · SKILL-007
Suspicious URLs
packages/dashboard/vite.config.ts · SKILL-007
Credential-to-network dataflow
packages/dashboard/vite.config.ts · SKILL-010
Code obfuscation
packages/dashboard/src/utils/containers.ts · SKILL-005

INT-000High

Multiple agent instructions contain directives to execute bundled scripts without validation: 'Do NOT attempt to write a manual extraction script as fallback — the bundled script is the sole extraction path' (file-analyzer.md) and 'If the script exits non-zero, read stderr and report the error' — agents are instructed to trust and run arbitrary binaries.
Architecture-analyzer.md includes a language directive that instructs agents to apply user-supplied language parameters to output fields, creating a vector for prompt injection: 'If the dispatch prompt includes a language directive (e.g., "Generate all textual content in **Chinese**"), apply it to: Layer `name` — Translate to the specified language' — this allows an attacker to inject instructions via the language parameter.
File-analyzer.md instructs agents to read and execute a bundled extraction script with minimal error handling, then proceed even if output is missing: 'Exit 0 with a missing output file means the bundled script silently no-opped — report this as a hard failure rather than proceeding to Step 3' — this guidance is contradictory and could lead to unsafe fallback behavior.

Details

Findings

PRM-003High

Multiple agents are instructed to execute arbitrary Node.js and Python scripts bundled with the plugin without explicit permission declarations: architecture-analyzer.md, file-analyzer.md, and graph-reviewer.md all invoke `node <SKILL_DIR>/extract-structure.mjs` and similar binaries.
Agents are instructed to read and write files across the project directory with broad glob patterns: 'Write a script (prefer Node.js; fall back to Python if unavailable)' with paths like `$PROJECT_ROOT/.understand-anything/tmp/` and `$PROJECT_ROOT/.understand-anything/intermediate/` — no scoping or permission checks are mentioned.
The assemble-reviewer.md agent is instructed to modify the assembled knowledge graph directly: 'Apply all fixes directly to `assembled-graph.json`' — this grants file_write authority without explicit permission boundaries.

Details

Findings

Evidence

file-analyzer.md: 'node <SKILL_DIR>/extract-structure.mjs ... $PROJECT_ROOT/.understand-anything/tmp/ua-file-analyzer-input-<batchIndex>.json'

Low

No MCP servers are declared in the profile; all tool invocations are described as bundled scripts executed locally within the agent's context.
The profile does not reference external network services, APIs, or MCP server definitions that would introduce network or credential risks.

Details

Evidence

Profile header states: '## MCP servers (untrusted data) (none)'
All script invocations reference local paths: `$SKILL_DIR`, `$PROJECT_ROOT`, `$PLUGIN_ROOT` — no external hosts or credentials mentioned.