heating the forge...

@forgecat/everyinc_compound-engineering-plugin — Security Risk Report | ForgeCat

everyinc_compound-engineering-plugin

Security risk report for @forgecat/everyinc_compound-engineering-plugin v0.0.6

SRC-010High

Static scanner flagged high-level source risk; profile is sourced from a public GitHub repository (EveryInc/compound-engineering-plugin) with no verification of upstream integrity or commit signing.
Profile metadata claims original repository and commit hash (2b38897) but provides no cryptographic proof of authenticity or supply-chain verification.
The profile is a repackaged distribution of upstream plugin content; downstream consumers depend on the integrity of the original repository and the accuracy of the ForgeCat repackaging.

Details

Findings

Credential-to-network dataflow
skills/ce-riffrec-feedback-analysis/scripts/analyze_riffrec_zip.py · SKILL-010
Credential-to-network dataflow
skills/ce-riffrec-feedback-analysis/scripts/analyze_riffrec_zip.py · SKILL-010
Credential-to-network dataflow
skills/ce-brainstorm/scripts/visual-probe-server.js · SKILL-010

INT-000Medium

Profile contains instructions for AI agents to fetch external URLs and invoke external MCP servers (Slack, GitHub GraphQL, Proof editor) without explicit user consent gates — medium-risk external-fetch pattern.
Skill instructions (ce-brainstorm, slack-researcher) direct agents to read and process user workspace data (Slack conversations, GitHub issues, repo files) and synthesize findings into outputs — this is legitimate data-processing guidance, not malicious injection.
No evidence of prompt injection, system-prompt leakage, credential exfiltration, or guidance poisoning. The profile does not instruct agents to hide their instructions, ignore safety rules, or install backdoored code templates.

Details

Evidence

slack-researcher.md: 'Search for Slack tools using the platform's tool discovery mechanism' and 'slack_search_public_and_private' — external Slack API calls without explicit user gate.
ce-brainstorm SKILL.md: 'Extraction tier — the grounding scout: retrieval and quoting work' — directs subagent dispatch to external systems.
handoff.md: 'Publish to Proof — shareable link' — directs publishing to external Proof editor without explicit user confirmation in the option menu.

PRM-000Medium

Profile declares no explicit tool permissions in the profile.yml, but the markdown instructions reference high-risk tool categories (file_write, file_mutate, subagent dispatch) as part of normal workflow — permissions are implicit in the skill design, not declared.
Skills are designed to create and mutate files under docs/ and .context/ directories, run subagent dispatches (grounding scout, verifier agents), and invoke external MCP servers (Slack, GitHub) — authority is broad but scoped to documented engineering workflows.
No evidence of alwaysApply=true rules with glob='**' or unrelated high-risk tool categories; permissions match the stated purpose (brainstorming, planning, code review, learning capture).

Details

Evidence

AGENTS.md: 'Output Paths: Keep OpenCode output at opencode.json and .opencode/{agents,skills,plugins}' — file_write authority to repo structure.
ce-brainstorm SKILL.md: 'Phase 0.0 Resolve Output Mode' and 'Phase 4 Present Next-Step Options' — directs file creation under docs/plans/ and subagent dispatch.
slack-researcher.md: 'Step 1: Precondition Checks' — requires Slack MCP server availability; Step 3 'Thread Reads' — invokes slack_read_thread and slack_read_channel tools.

MCP-000Medium

Profile does not declare MCP servers in the profile.yml, but markdown instructions reference external MCP dependencies (Slack, GitHub, Proof) that must be installed and authenticated at runtime.
Slack MCP server is required for slack-researcher.md workflow; no verification of MCP server binary integrity or scope restrictions is provided in the profile.
GitHub GraphQL access (ce-resolve-pr-feedback skill, referenced in CHANGELOG) and Proof editor integration require external host access and authentication — medium-risk external dependency pattern.

Details

Evidence

slack-researcher.md: 'This agent depends on a Slack MCP server. Verify availability before doing any work' — explicit MCP dependency without integrity verification.
CHANGELOG.md: 'ce-resolve-pr-feedback: paginate GraphQL connections' — implies GitHub MCP or GraphQL tool integration.
handoff.md: 'Publish to Proof — shareable link' — external Proof editor integration without declared MCP server in profile.