Security risk report for @forgecat/openai_skills_security-ownership-map v0.0.11
Source Integrity
Low
Profile is attributed to OpenAI with a specific GitHub repository and commit hash (0e7823cca07bc2cbf34718a383f9ae92525be6a5), providing traceability.
Licensed under Apache-2.0, a well-known open-source license.
No suspicious package dependencies or typosquatted imports; only `networkx` is required, a legitimate and widely-used graph library.
Agent Intent
Low
The profile describes a legitimate security analysis tool (ownership mapping, bus factor computation) with clear, bounded use cases; no instructions to manipulate the AI or hide its own behavior.
Documentation is descriptive and educational—it explains how to run the tool, configure sensitivity rules, and query outputs; it does not instruct the AI to ignore instructions, leak system prompts, or perform unauthorized actions.
The skill is scoped to git repository analysis and graph export; no guidance poisoning, no instructions to weaken security defaults, no embedded backdoored code templates, and no persistent biased rules steering future outputs toward attacker goals.
Details
Evidence
Trigger condition is explicit: 'Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history.'
All commands shown are standard Python CLI invocations with documented flags (--repo, --out, --since, etc.).
No references to fetching external URLs, installing remote payloads, or exfiltrating data to attacker-controlled hosts.
Permissions
PRM-000Medium
The skill requires file_read access to clone/analyze git repositories and read commit history, which is appropriate for its stated purpose.
It also requires file_write access to output CSV/JSON artifacts to the local filesystem (ownership-map-out/), which is necessary and expected.
However, the scope is somewhat broad: the skill can analyze any git repository the user provides (--repo /path/to/repo), and the output directory is user-configurable; no explicit restrictions on repository size, commit history depth, or output volume are documented, which could lead to resource exhaustion or unintended data collection.
Details
Evidence
Scripts reference --repo, --out, --since/--until, and --emit-commits, indicating file system traversal and write operations.
No alwaysApply=true rules or globs='**' patterns are declared, so permissions are not automatically excessive.
The skill does not declare shell execution, network access, or subagent invocation; it is a local analysis tool.
MCP Risk
Low
No MCP servers are declared in the profile, so there is no risk from hidden tool definitions or arbitrary binary execution.
The skill relies on standard Python libraries (networkx) and git CLI, both well-known and widely audited.
All operations are local to the user's filesystem; no external network calls or unrestricted host access are documented.
Details
Evidence
Dependencies section lists only 'None' in the profile header; SKILL.md mentions only networkx, a legitimate PyPI package.
Neo4j import instructions are optional and user-initiated (not automatic); they describe how to persist data locally, not how to exfiltrate it.
No references to downloading or executing remote binaries, fetching code from untrusted sources, or connecting to external APIs.
ForgeCat