heating the forge...

@forgecat/msitarzewski_agency-agents_agency-support — Security Risk Report | ForgeCat

msitarzewski_agency-agents_agency-support

Security risk report for @forgecat/msitarzewski_agency-agents_agency-support v0.0.11

Low

Profile sourced from public GitHub repository (msitarzewski/agency-agents) with clear attribution and MIT license.
Original commit hash and repository URL provided for transparency and auditability.
No supply-chain red flags; legitimate open-source origin with version tracking.

Low

Content describes legitimate business agent personas (analytics, finance, legal, support, infrastructure, executive communication) with no instructions to manipulate the AI, exfiltrate data, or bypass security controls.
Code templates and frameworks are standard industry practices (SQL queries, Python analytics, Terraform IaC, GDPR compliance configs) — not poisoned guidance or attacker-serving instructions.
No prompt injection, system prompt leakage, role hijacking, or instructions to read credentials, execute remote payloads, or hide instructions.

Details

Findings

Invisible characters detected
agents/support-infrastructure-maintainer.md · SKILL-011
Invisible characters detected
agents/support-legal-compliance-checker.md · SKILL-011

Evidence

All agent descriptions focus on business functions: 'transforms raw data into actionable insights', 'maintains financial health', 'ensures compliance', 'optimizes infrastructure'.
Code examples are legitimate templates (Prometheus monitoring, AWS Terraform, SQL analytics, Python data science) with no backdoors, typosquatted dependencies, or security-weakening directives.
No language instructing the AI to ignore its system prompt, reveal hidden instructions, or perform unauthorized actions.

Low

Profile declares no tools, hooks, or MCP servers — only markdown agent personality definitions and code templates.
No excessive agency risk: agents are instructional personas without executable permissions or tool bindings that could grant shell, file write/delete, or unrestricted network access.
Authority is scoped to the agent's stated domain (analytics, finance, legal, support, infrastructure) through personality guidance, not through dangerous tool configurations.

Details

Evidence

'Declared tools' section is empty; no tool definitions with alwaysApply=true or glob patterns.
MCP servers section is empty; no external binary execution or unrestricted filesystem/network access defined.
Content is pure markdown instruction and code templates — no permission grants or capability escalation mechanisms.

Low

No MCP servers are defined in the profile; no external host access, binary execution, or credential requirements.
Profile contains only markdown agent definitions and code templates — no MCP server configurations with hidden instructions or dangerous tool descriptions.
Infrastructure and legal agents include example configurations (Prometheus YAML, Terraform HCL, GDPR framework) but these are templates for human review, not active MCP definitions.

Details

Evidence

'MCP servers' section is empty.
Code examples (Terraform, Prometheus, Python) are illustrative templates, not active MCP tool definitions with unrestricted access.
No references to external binaries, arbitrary command execution, or credential injection in MCP context.