heating the forge...

@forgecat/msitarzewski_agency-agents_agency-specialized — Security Risk Report | ForgeCat

msitarzewski_agency-agents_agency-specialized

Security risk report for @forgecat/msitarzewski_agency-agents_agency-specialized v0.0.12

Low

Static scanner rated safe; profile is sourced from msitarzewski/agency-agents GitHub repository, a known public source.
No evidence of typosquatted dependencies, attacker-controlled package names, or supply-chain poisoning in the reviewed agent descriptions.
Installation command uses legitimate ForgeCat registry syntax; no redirection to malicious mirrors detected.

SRC-010Medium

The Agents Orchestrator agent instructs spawning sub-agents and running shell commands (ls, grep, cat) as part of its pipeline workflow, representing self-expanding authority and subagent orchestration patterns.
Several agents (Accounts Payable, Identity Graph Operator, Agents Orchestrator) describe autonomous execution of high-stakes actions — financial payments, infrastructure changes — with minimal human-in-the-loop, which could amplify the impact of any downstream prompt injection.
No direct prompt injection, credential exfiltration, role hijacking, or system prompt leakage instructions were found; the content is domain-specific operational guidance rather than adversarial manipulation.

Details

Findings

Invisible characters detected
agents/agents-orchestrator.md · SKILL-011
Invisible characters detected
agents/automation-governance-architect.md · SKILL-011
Invisible characters detected
agents/blockchain-security-auditor.md · SKILL-011
Invisible characters detected
agents/data-consolidation-agent.md · SKILL-011
Invisible characters detected
agents/government-digital-presales-consultant.md · SKILL-011
Invisible characters detected
agents/healthcare-marketing-compliance.md · SKILL-011
Invisible characters detected
agents/identity-graph-operator.md · SKILL-011
Invisible characters detected
agents/specialized-developer-advocate.md · SKILL-011
Invisible characters detected
agents/specialized-salesforce-architect.md · SKILL-011
Invisible characters detected
agents/specialized-workflow-architect.md · SKILL-011
Invisible characters detected
agents/zk-steward.md · SKILL-011

Evidence

PRM-000Medium

No tools are formally declared, but the Agents Orchestrator agent describes shell command execution (ls, grep, cat) and spawning multiple sub-agents, implying broad filesystem and subagent authority.
The Accounts Payable agent describes autonomous financial transaction execution across multiple payment rails (ACH, wire, crypto, stablecoins) — high-impact authority for an AI agent.
The scope of authority described across the 27 agents collectively (payments, identity systems, compliance auditing, blockchain operations) is significantly broader than any single stated purpose, though each individual agent is scoped to its domain.

Details

Evidence

agents-orchestrator.md: 'ls -la project-specs/*-setup.md', 'TASK_COUNT=$(grep -c ...)'
accounts-payable-agent.md: 'Execute vendor and contractor payments', 'Route payments through the optimal rail (ACH, wire, crypto, stablecoin)'
agents-orchestrator.md: 'Spawn appropriate developer agent... Frontend Developer, Backend Architect, engineering-senior-developer, Mobile App Builder, DevOps Automator'

Low

No MCP servers are declared in the profile; the agents are described as markdown personalities and workflows, not as MCP server definitions.
The profile is a collection of agent role descriptions and operational workflows, not a Model Context Protocol server configuration.
No hidden instructions in tool descriptions, no arbitrary binary execution, and no unrestricted network/filesystem access declared at the MCP level.

Details

Evidence

Profile header: 'MCP servers (untrusted data): (none)'
Content is markdown-based agent personalities with TypeScript/Python pseudocode examples, not MCP tool definitions.