Security risk report for @forgecat/openai_skills_gh-address-comments v0.0.11
Source Integrity
Low
Profile is sourced from OpenAI's official skills repository (https://github.com/openai/skills) with clear attribution and commit hash.
Distributed through ForgeCat registry with documented version control and license (Apache-2.0).
Agent Intent
INT-000Medium
The skill instructs the agent to run an external script (`scripts/fetch_comments.py`) whose contents are not provided or verified, creating a potential for arbitrary code execution via an unreviewed dependency.
The instruction to rerun `gh auth status` with `sandbox_permissions=require_escalated` is a suspicious attempt to escalate permissions beyond what a comment-addressing workflow requires, nudging the agent to bypass sandbox restrictions.
The phrase 'Run all `gh` commands with elevated network access' is broader than necessary for the stated purpose and could be used to justify excessive network operations.
Details
Evidence
"Run scripts/fetch_comments.py which will print out all the comments and review threads on the PR"
"rerun it with `sandbox_permissions=require_escalated`"
"Run all `gh` commands with elevated network access"
Permissions
PRM-000Medium
The profile requests escalated sandbox permissions and elevated network access, which exceed what is needed to simply read and address PR comments via `gh` CLI.
Instructing the agent to run an unverified external Python script (`fetch_comments.py`) implicitly demands script-execution authority beyond the profile's stated purpose.
No high-risk tool categories (shell, file_write, file_delete) are explicitly declared, but the prose instructions effectively invoke shell-level execution through script invocation and permission escalation.
Details
Evidence
"rerun it with `sandbox_permissions=require_escalated`"
"Run scripts/fetch_comments.py"
"Run all `gh` commands with elevated network access"
MCP Risk
Low
No MCP servers are declared in the profile.
Profile relies on standard gh CLI tool (well-known, legitimate) rather than custom or unknown binaries.
ForgeCat