heating the forge...

@forgecat/openai_skills_screenshot — Security Risk Report | ForgeCat

openai_skills_screenshot

Security risk report for @forgecat/openai_skills_screenshot v0.0.10

SRC-010Medium

Profile sourced from OpenAI's public skills repository (GitHub: openai/skills), a known and legitimate upstream.
Static scanner flagged tool-source hint; however, the Python/PowerShell/Bash scripts are standard OS-level screenshot utilities with no obfuscation or hidden payloads evident in the documented usage.

Details

Findings

Low

Content describes legitimate screenshot capture workflows with clear, documented tool usage (Python, PowerShell, Bash helpers).
No instructions to ignore system prompts, exfiltrate credentials, read sensitive files, or hide its own behavior.
No guidance poisoning: recommends standard, well-known OS tools (scrot, gnome-screenshot, ImageMagick, screencapture) and does not plant malicious dependencies or weaken security defaults.

Details

Findings

Invisible characters detected
skills/screenshot/scripts/take_screenshot.py · SKILL-011

Evidence

README and SKILL.md document only screenshot capture mechanics, platform compatibility, and error handling.
All code examples are transparent OS-level commands (screencapture, scrot, gnome-screenshot, PowerShell Get-Image) with no obfuscated payloads.
Permission preflight on macOS is a legitimate UX pattern to reduce repeated sandbox prompts, not a manipulation technique.

PRM-000Medium

The skill requests macOS Screen Recording permission and instructs the agent to re-run commands with 'escalated permissions' if sandboxed — authority that goes beyond a minimal screenshot utility.
Execution of arbitrary shell, Python, and PowerShell scripts from bundled paths is a medium-to-high risk capability; no declared tools are listed, yet the skill effectively grants shell execution authority through its instructions.
The scope (full desktop, all windows, all displays, pixel regions) is broad but consistent with the stated screenshot purpose; the concern is the unverified script execution pathway rather than the screenshot function itself.

Details

Evidence

"rerun the command with escalated permissions"
"bash <path-to-skill>/scripts/ensure_macos_permissions.sh && python3 <path-to-skill>/scripts/take_screenshot.py"
"powershell -ExecutionPolicy Bypass -File <path-to-skill>/scripts/take_screenshot.ps1"

Low

No MCP servers declared in the profile.
No hidden instructions in tool descriptions or arbitrary binary execution.
Skill relies on bundled, documented helper scripts (Python, Bash, PowerShell) with transparent command-line interfaces.

Details

Evidence

Profile explicitly states 'Dependencies: None' and lists no MCP server definitions.
All tool invocations are documented with explicit command-line flags and examples.
Scripts are sourced from OpenAI's public repository, not from unknown or untrusted binaries.