heating the forge...

@forgecat/juliusbrussee_caveman — Security Risk Report | ForgeCat

juliusbrussee_caveman

Security risk report for @forgecat/juliusbrussee_caveman v0.1.6

SRC-003High

Static scanner flagged high-level source risk; profile is a converted ForgeCat package from upstream GitHub repository (https://github.com/JuliusBrussee/caveman) with version mismatch (profile claims 0.1.6, README shows 0.1.5) and references to original repository paths that may not align with ForgeCat distribution.
CLAUDE.md explicitly documents that ForgeCat intentionally excludes upstream top-level bin/, src/, and full hooks/ tree; only skill directories are packaged, creating a supply-chain divergence between upstream source and ForgeCat runtime bundle.
Profile includes curl-to-shell and PowerShell remote-exec install commands marked as 'omitted in ForgeCat profile' — this is a signal of intentional modification from upstream, but the actual install mechanism (npx forgecat) is safe and does not execute remote code.

Details

Findings

CLAUDE.md:214
CLAUDE.md:214
Credential-to-network dataflow
skills/caveman/hooks/caveman-stats.js · SKILL-010
Remote payload execution
skills/caveman/src/tools/caveman-init.js · SKILL-003

Low

Profile content is a productivity/token-efficiency toolkit (caveman communication mode) with no instructions to manipulate the AI into ignoring its system prompt, reading credentials, exfiltrating data, or installing remote payloads.
All skill definitions (caveman, caveman-commit, caveman-review, caveman-compress, cavecrew subagents) are self-contained compression/formatting rules with clear boundaries; no guidance poisoning detected — the rules do not instruct weakening security defaults, disabling TLS, logging credentials, or installing backdoored dependencies.
Auto-clarity rules explicitly instruct dropping caveman mode for security warnings and irreversible-action confirmations, demonstrating defensive intent rather than manipulation; no system prompt leakage, role hijacking, or hidden instruction-reading directives found.

Details

Findings

Invisible characters detected
README.md · SKILL-011
Invisible characters detected
skills/caveman-compress/scripts/compress.py · SKILL-011

Evidence

caveman/SKILL.md: 'Auto-Clarity: drop caveman when: Security warnings, Irreversible action confirmations...'
caveman-compress/SECURITY.md: 'Does not execute user file content as code, does not make network requests except to Anthropic's API, does not access files outside the path the user provides'

PRM-003Medium

Hook scripts (caveman-activate.js, caveman-mode-tracker.js, codex-session-start.sh) are referenced but their full content is not visible in the reviewed files, creating uncertainty about what filesystem or shell access they exercise at session start.
The cavecrew-investigator agent declares Bash tool access, which combined with read-only intent is somewhat broader than strictly necessary — though its instructions limit Bash to git log/grep/find commands.
The caveman-compress skill invokes Python subprocess execution on user-specified files and optionally shells out to the claude CLI, which is broader than a pure text-transformation skill would require, though bounded by explicit file-type restrictions.

Details

Findings

Evidence

Low

Profile declares no MCP servers; caveman-compress references a local Python script (scripts/__main__.py) but this is not an MCP server definition — it is a subprocess call with fixed arguments and no network access beyond Anthropic's API.
caveman-shrink is mentioned as an npm-published MCP middleware in the README but is not included in the ForgeCat profile bundle; the profile itself contains no MCP server definitions with hidden instructions, arbitrary binary execution, or unrestricted network/filesystem access.
All skill definitions are markdown-based rule files with no embedded binary execution, tool descriptions are transparent and match stated function (compression, review, commit generation), and no external host access is configured.

Details

Evidence

Profile metadata: '(none)' for MCP servers
caveman-compress/SKILL.md: 'python3 -m scripts <absolute_filepath>' is a local subprocess, not an MCP server
README.md: 'caveman-shrink npm-published MCP middleware' is referenced but not bundled in this ForgeCat profile