Security risk report for @forgecat/mattpocock_skills v0.1.2
Source Integrity
SRC-010Medium
Profile is sourced from a public GitHub repository (mattpocock/skills) with a clear attribution and MIT license.
Static scanner flagged medium risk; likely reflects that the profile depends on external resources (CDN-hosted Tailwind, Mermaid, Cloudinary images) and references external platforms (GitHub, Linear, newsletter signup), introducing supply-chain exposure if those hosts are compromised.
Details
Findings
Data exfiltration
skills/tdd/mocking.md · SKILL-002
Agent Intent
Low
Profile contains no instructions to manipulate the AI, ignore system prompts, exfiltrate credentials, or hide its own instructions.
Content describes legitimate engineering workflows (TDD, debugging, architecture review, documentation) with no guidance poisoning or malicious knowledge injection.
References to external URLs (GitHub, newsletter, CDN resources) are standard practice for skill distribution and do not instruct the agent to fetch or execute untrusted payloads.
Details
Evidence
All skills are described as legitimate engineering practices: 'diagnose' (debugging loop), 'tdd' (test-driven development), 'improve-codebase-architecture' (refactoring guidance).
No instructions to read ~/.ssh, ~/.aws, .env, or exfiltrate environment variables.
No instructions to reveal system prompts, tool definitions, or conversation memory.
No instructions to install remote payloads or weaken security defaults (e.g., disable TLS, log credentials).
Permissions
Low
Skills are described as markdown-based instructions and do not declare shell, file_write, file_delete, or other high-risk tool categories.
The 'git-guardrails-claude-code' skill explicitly restricts dangerous git operations (push, reset --hard, clean, branch -D) rather than enabling them.
Authority matches stated function: skills guide the AI through engineering workflows without requesting excessive system access.
Details
Evidence
git-guardrails-claude-code SKILL.md: 'Sets up a PreToolUse hook that intercepts and blocks dangerous git commands before Claude executes them.'
No skills declare alwaysApply=true with globs='**' or request unrestricted filesystem/network access.
Skills reference reading project files (CONTEXT.md, ADRs, source code) which is appropriate for their stated purpose (architecture review, documentation).
MCP Risk
Low
Profile declares no MCP servers; all skills are markdown-based instructions and guidance.
No hidden instructions in tool descriptions, no arbitrary binary execution, no unrestricted network or filesystem access.
External resource references (GitHub, CDN links) are standard and do not constitute MCP server definitions.
Details
Evidence
Profile metadata states 'Dependencies: None' and lists no MCP server configurations.
All skills are documented as markdown files with plain-English instructions, not binary executables or server definitions.
ForgeCat