Security risk report for @forgecat/mattpocock_skills v0.1.1
Source Integrity
SRC-010Medium
Profile is sourced from a public GitHub repository (mattpocock/skills) with a clear attribution and MIT license.
Static scanner flagged caution, likely because the profile references external resources (CDN images, newsletter signup) and depends on external tooling (npx forgecat, skills.sh installer).
No evidence of supply-chain poisoning or typosquatted dependencies; all references are to legitimate, well-known projects (Total TypeScript, Husky, Prettier).
Details
Findings
Data exfiltration
skills/tdd/mocking.md · SKILL-002
Agent Intent
Low
Content describes legitimate engineering workflows (TDD, debugging, architecture review, issue triage) without instructing the agent to ignore its instructions, read credentials, or exfiltrate data.
No system prompt leakage instructions detected; the skills are designed to help users organize their own work, not to manipulate the agent into revealing hidden instructions.
Guidance is constructive and security-aware: the 'git-guardrails-claude-code' skill explicitly blocks dangerous git operations; the 'diagnose' skill teaches disciplined debugging; no malicious knowledge is planted.
Details
Evidence
Example from diagnose/SKILL.md: 'Build the right feedback loop, and the bug is 90% fixed' — teaches methodology, not manipulation.
Example from git-guardrails-claude-code/SKILL.md: 'blocks dangerous git commands (push, reset --hard, clean, branch -D, etc.) before they execute' — actively prevents harm.
caveman/SKILL.md describes a communication mode, not an instruction to bypass safety or hide behavior.
Permissions
PRM-000Medium
No tools are formally declared, but several skills instruct the agent to write files to the OS temp directory, open files with system commands (xdg-open/open/start), and run shell commands like chmod and grep.
The improve-codebase-architecture skill instructs spawning sub-agents via an Agent tool with subagent_type=Explore, which is a medium-risk capability.
These permissions are broadly consistent with the stated engineering/productivity purpose, but the combination of file writes, shell execution, and sub-agent spawning represents authority somewhat beyond a pure advisory skill.
Details
Evidence
skills/improve-codebase-architecture/SKILL.md: 'Write a self-contained HTML file to the OS temp directory... Open it for the user — xdg-open <path> on Linux, open <path> on macOS, start <path> on Windows'
skills/improve-codebase-architecture/SKILL.md: 'use the Agent tool with subagent_type=Explore to walk the codebase'
skills/git-guardrails-claude-code/SKILL.md: 'Copy it to the target location... Make it executable with chmod +x'
MCP Risk
Low
No MCP servers are declared in the profile; all skills are self-contained markdown instructions and do not invoke external binaries or network services.
Skills that interact with external systems (GitHub, Linear, issue trackers) do so through the agent's existing tool capabilities (web_fetch, subagent), not through custom MCP definitions.
The profile does not attempt to install or execute arbitrary binaries; it references legitimate, well-known tools (Husky, Prettier, Playwright) that the user would install separately via their project's package manager.
Details
Evidence
No 'mcp_servers' or 'tools' section in the profile YAML.
All external integrations (GitHub, Linear) are described as user-configurable options in setup steps, not as hidden MCP definitions.
Example from setup-pre-commit/SKILL.md: 'Set up Husky pre-commit hooks with lint-staged (Prettier)' — describes a standard, auditable setup, not a hidden binary.
ForgeCat