Security risk report for @forgecat/leonxlnx_taste-skill v0.1.5
Source Integrity
Low
Profile is sourced from a legitimate GitHub repository (Leonxlnx/taste-skill) with clear attribution and MIT license.
Original commit hash provided for traceability (5436c5952cc88d18a034d496988680a8c28a836a).
Static scanner confirms safe level; no supply-chain poisoning indicators detected.
Agent Intent
SRC-010Medium
Content contains extensive prescriptive guidance that shapes AI behavior toward specific design outputs (e.g., 'BANNED FOREVER', 'CRITICAL OUTPUT RULE', 'MANDATORY'), which could be interpreted as guidance poisoning if the intent is to lock the AI into non-standard or security-weakening patterns.
Multiple skills instruct the AI to override or suppress default LLM behaviors ('aggressively break these defaults', 'override default LLM truncation behavior', 'Overrides default LLM truncation behavior'), which is a form of behavioral steering but appears design-focused rather than security-weakening.
No evidence of instructions to read credentials, exfiltrate data, hide instructions, install remote payloads, or weaken security controls; the guidance is purely aesthetic and UX-focused, not malicious.
Details
Findings
Prompt injection
skills/taste-skill/SKILL.md · SKILL-006
Evidence
gpt-taste/SKILL.md: 'Your goal is to aggressively break these defaults.'
ForgeCat