Security risk report for @forgecat/fivetaku_fablize v0.1.3
Source Integrity
Low
Static scanner assigned low-level source risk; profile is published under MIT license with clear attribution to original author (fivetaku) and GitHub repository link.
README and CHANGELOG document version history, commit hash, and release date transparently; no evidence of supply-chain poisoning or typosquatted dependencies.
Dependencies listed are standard (bash, python3, optional gh CLI) — all well-known, legitimate tools with no attacker-controlled or obfuscated package names.
Agent Intent
Low
Content describes a verification harness and investigation procedure; no instructions to ignore system prompts, read credentials, exfiltrate data, or hide its own instructions.
CHANGELOG and README document legitimate security fixes (e.g., 'Stop hook transcript_path validation' to block arbitrary file reads, 'consent-first' removal of silent auto-starring) — these are security *improvements*, not poisoning.
Setup flow includes explicit opt-in for GitHub starring and language-aware user prompts; no hidden guidance to weaken security defaults or install backdoored code templates.
setup.md §3: 'If the output starts with STAR_ASK, immediately call the AskUserQuestion tool once' — explicit user consent required, not silent.
SKILL.md §4: 'These are capability, not procedure, and a harness cannot fill them' — honest about limits, no false claims of capability injection.
Permissions
PRM-003Medium
Four hook scripts (router.sh, gate_prompt.py, gate_stop.py, router-codex.sh) are declared but have no matching tool category declarations, meaning their actual permission scope cannot be verified from the profile alone.
The setup command runs bash scripts that write to `~/.fablize/`, inject blocks into `CLAUDE.md`, and optionally invoke `gh` (GitHub CLI) — these constitute file_write and potentially shell execution authority beyond a pure read-only harness.
The `goals.py` script and hook gates read/write session state files and intercept every prompt submission (UserPromptSubmit hooks), which is broader than strictly necessary for a verification harness but consistent with the stated always-on routing purpose.
Details
Findings
./hooks/router.sh
./hooks/gate_prompt.py
./hooks/gate_stop.py
./hooks/router-codex.sh
Evidence
MCP Risk
Low
No MCP servers declared in the profile; the harness relies on local bash/python3 helpers and Claude Code's native tool ecosystem.
Dependencies are standard CLI tools (bash, python3, optional gh) — no unknown binaries, arbitrary code execution, or unrestricted network access.
Helper scripts (goals.py, setup.sh) are part of the published GitHub repository and subject to version control and community review.
Details
Evidence
Profile declares '(none)' for MCP servers.
README dependencies: 'bash for hook and setup scripts, python3 for the goal ledger, setup helpers, and gate hooks, Optional: gh for the explicit opt-in GitHub star flow'.
All scripts reference FABLIZE_ROOT (plugin installation directory) with fallback path resolution — no remote code loading.
Evaluation Details
Status
Completed
Checks completed
4/4
Flagged
1
Evaluated
7/6/2026
'bash ${FABLIZE_ROOT}/setup/setup.sh <local|global>' writes to CLAUDE.md and ~/.fablize/ (commands/setup.md §Step 2)
Hook files: ./hooks/router.sh, ./hooks/gate_prompt.py, ./hooks/gate_stop.py, ./hooks/router-codex.sh — flagged by static scanner as [permissions/hook-no-tool-match]
'Optional: gh for the explicit opt-in GitHub star flow' (README.md §Dependencies)
ForgeCat