Security risk report for @forgecat/openai_skills_develop-web-game v0.0.11
Source Integrity
Low
Profile is attributed to OpenAI with a public GitHub repository (openai/skills) and Apache-2.0 license.
Commit hash and timestamp provided; sourced from a well-known, legitimate upstream.
Agent Intent
Low
Content describes a legitimate web-game development workflow using Playwright for testing and validation; no instructions to ignore system prompts, exfiltrate credentials, or execute remote payloads.
Guidance is standard software engineering practice (test-driven iteration, state inspection, error checking); no malicious knowledge poisoning or security-weakening directives.
References to external resources (GitHub banner URL, action payloads JSON) are for documentation and configuration, not for fetching and executing untrusted code.
Details
Evidence
Workflow steps 1–14 describe iterative game development with Playwright testing, screenshot inspection, and console error review.
No instructions to read ~/.ssh, ~/.aws, .env, or transmit data to external hosts.
No directives to hide instructions, disable security features, or install backdoored dependencies.
Permissions
Low
Profile declares no tools or MCP servers; it is purely instructional documentation for a development workflow.
Permissions are implicit to the Codex/Cursor/Claude Code environment (file read/write for game code, local Playwright execution); no excessive or unrelated authority requested.
Details
Evidence
Dependencies field lists 'None'.
No tool definitions, shell commands, or file-mutation directives beyond standard game development (editing HTML/JS files).
MCP Risk
Low
No MCP servers are defined in the profile.
The profile is a skill/workflow guide, not a server configuration; no binary execution or network access is declared.
ForgeCat