Security risk report for @forgecat/mango_skills_agent-skills-codex v0.1.2
Source Integrity
Low
Static scanner assigned low-risk source; the profile is published under @forgecat namespace with a clear version (0.1.2) and references legitimate, well-known open-source and commercial tools (ffmpeg, Pillow, Python, Framer, GitHub, ElevenLabs).
No typosquatted packages, attacker-controlled repositories, or suspicious binary downloads are recommended; all external dependencies are standard and documented.
The profile does not instruct installing arbitrary remote payloads or fetching unverified code from untrusted hosts.
Agent Intent
Low
The profile contains detailed procedural guidance for legitimate design and development workflows (skill extraction, originality auditing, video rendering, site building) with no instructions to manipulate the AI, exfiltrate credentials, or hide its own instructions.
References to 'ignore previous instructions' and prompt injection appear only in the audit-reference-originality skill as EXAMPLES of what to look for in plagiarism detection, not as directives to the agent—this is describing a security concern, not instructing malicious behavior.
No guidance poisoning detected; the profile does not plant malicious knowledge, weaken security defaults, or instruct the agent to systematically steer outputs toward attacker goals. Recommendations for tools (ffmpeg, Python, Pillow) are standard and legitimate.
Details
Evidence
audit-reference-originality/SKILL.md: 'Call findings `originality risks`, `overlaps`, or `red flags`; do not declare legal plagiarism from visual similarity alone.' — describes audit methodology, not instruction to manipulate.
browser-video-recording/SKILL.md: 'Do not use Chrome when the user asks for Codex browser or the project says not to.' — enforces user intent, not agent hijacking.
build-daily-inspiration-sites/SKILL.md: 'Do not recollect inspiration unless the user explicitly asks.' — preserves user agency and task boundaries.
Permissions
PRM-000Medium
The profile instructs use of web_fetch (browser automation, live-page inspection, reference URL access), file_write (creating skills, committing to git, publishing to GitHub), and subagent/task-creation (spawning five separate Codex tasks for site builds), which are medium-risk categories.
Authority is somewhat broader than a single narrow function: the profile bundles auditing, video rendering, site building, skill authoring, and GitHub publishing into one agent profile, each with distinct tool requirements.
No high-risk categories (shell execution, file_delete, unrestricted filesystem mutation) are requested with alwaysApply=true or globs='**'; file operations are scoped to specific project directories and git workflows.
Details
Evidence
build-daily-inspiration-sites/SKILL.md: 'Create all five tasks with their complete briefs.' — instructs spawning multiple subagents/tasks.
publish-project-to-github skill (referenced in README): 'push it safely, configure a public GitHub Pages URL' — requires file_write and web_fetch authority.
article-prompts-to-skills/SKILL.md: 'Stage the new skill folders and the gallery files they require. Review `git diff --cached --stat`' — requires file_write and git mutation.
MCP Risk
Low
No MCP servers are declared in the profile; the skills reference external tools (ffmpeg, Python, Pillow, git, GitHub API, Sites plugin, Codex browser) but do not define custom MCP server configurations.
The profile instructs using existing, well-known tools and Codex built-in features (in-app browser, Sites plugin, task creation) rather than arbitrary binary execution or hidden MCP definitions.
References to 'Browser skill/MCP' and 'native recording MCP' are conditional fallbacks with explicit safety checks ('If unavailable, blocked, or unable to capture the Codex browser surface, fall back to the screenshot-to-video renderer and explain the fallback').
Details
Evidence
browser-video-recording/SKILL.md: 'Optional native recorder integration: Use a native recording MCP only when callable and explicitly useful... If unavailable, blocked, or unable to capture the Codex browser surface, fall back to the screenshot-to-video renderer and explain the fallback.' — defensive MCP usage.
No tool descriptions contain hidden instructions or obfuscated payloads.
All external binaries (ffmpeg, ffprobe, python3) are standard, open-source, and explicitly named.
ForgeCat