heating the forge...

@forgecat/msitarzewski_agency-agents_agency-marketing — Security Risk Report | ForgeCat

msitarzewski_agency-agents_agency-marketing

Security risk report for @forgecat/msitarzewski_agency-agents_agency-marketing v0.0.11

Low

Profile sourced from msitarzewski/agency-agents public repository on GitHub; no supply-chain poisoning or typosquatted dependencies detected.
Static scanner confirms safe level; no malicious package recommendations or backdoored code templates present.

SRC-010Medium

The Carousel Growth Engine agent explicitly instructs the AI to operate with 'Zero Confirmation' and 'never ask for permission between steps,' directing fully autonomous publishing to TikTok and Instagram — this is a self-expanding authority pattern that bypasses human oversight.
The same agent instructs fetching and scraping arbitrary external URLs via Playwright and posting results publicly, which constitutes instructed external URL fetching combined with autonomous publishing without user approval.
All other agents (SEO, ASO, content strategy, etc.) contain only legitimate domain-specific guidance with no manipulation, role-hijacking, credential-reading, or exfiltration instructions — the concern is isolated to the Carousel Growth Engine's autonomy directives.

Details

Findings

Invisible characters detected
agents/marketing-app-store-optimizer.md · SKILL-011
Invisible characters detected
agents/marketing-content-creator.md · SKILL-011
Invisible characters detected
agents/marketing-livestream-commerce-coach.md · SKILL-011

Evidence

"Zero Confirmation: Run the entire pipeline without asking for user approval between steps"
"Notify Only at End: The user sees results (published URLs), not process updates"
"Self-Schedule: Read learnings.json bestTimes and schedule next execution at the optimal posting time"

PRM-000Medium

The Carousel Growth Engine agent requires external network access to arbitrary URLs (Playwright scraping), two third-party API credentials (GEMINI_API_KEY, UPLOADPOST_TOKEN/USER), and autonomous public posting to social media platforms — authority significantly broader than a typical marketing assistant.
The agent also instructs writing to the local filesystem (/tmp/carousel/learnings.json, analysis.json, post-info.json, slide-prompts.json) and self-scheduling future executions, which exceeds the scope of a content-generation helper.
The remaining 26 agents declare no tools and operate as advisory/content-drafting personas with minimal authority, keeping the overall profile mostly within reasonable bounds.

Details

Evidence

"Storage: /tmp/carousel/learnings.json — persistent knowledge base updated after every post"
"Credential: GEMINI_API_KEY environment variable" and "UPLOADPOST_TOKEN and UPLOADPOST_USER environment variables"
"Self-Schedule: Read learnings.json bestTimes and schedule next execution at the optimal posting time"

Low

No MCP servers are declared in the profile; all integrations are via standard REST APIs (Gemini, Upload-Post, Baidu, Bilibili, TikTok) with explicit credential management via environment variables.
Tool descriptions are transparent about their function and scope; no hidden instructions or arbitrary binary execution detected.
API integrations follow standard OAuth/token-based authentication patterns without unrestricted network or filesystem access.

Details

Evidence

Profile declares: '(none)' for MCP servers
Carousel Growth Engine specifies: 'GEMINI_API_KEY environment variable (free tier available)' and 'UPLOADPOST_TOKEN and UPLOADPOST_USER environment variables' — explicit credential scoping
All external integrations are documented with clear API endpoints and authentication methods