Security risk report for @forgecat/openai_skills_system-openai-docs v0.0.11
Source Integrity
Low
Profile is sourced from OpenAI's official repository (github.com/openai/skills) with Apache-2.0 license.
Metadata includes verifiable commit hash and timestamp; no supply-chain red flags detected.
Agent Intent
Low
Content describes legitimate OpenAI documentation lookup and model-upgrade workflows; no instructions to ignore system prompts, exfiltrate credentials, or execute remote payloads.
Prompt-rewrite guidance (e.g., `tool_persistence_rules`, `verification_loop`) is educational scaffolding for legitimate model-upgrade tasks, not malicious knowledge poisoning—it teaches best practices for GPT-5.4 compatibility, not security-weakening defaults.
Reference to 'escalated permissions' for MCP install is a fallback workflow hint, not an instruction to hide actions or bypass controls; it explicitly requires user restart and re-validation.
Details
Evidence
"Treat OpenAI docs as the source of truth; avoid speculation."
"If the MCP server is installed but returns no meaningful results, then use web search as a fallback."
"If it fails due to permissions/sandboxing, immediately retry the same command with escalated permissions and include a 1-sentence justification for approval. Do not ask the user to run it yet."
Permissions
Low
No file_write, file_delete, shell, or high-risk tool categories are declared in the profile.
MCP server is read-only documentation lookup (developers.openai.com/mcp); no mutation or system-level access requested.
Web-search fallback is scoped to official OpenAI domains (developers.openai.com, platform.openai.com) with explicit citation requirements.
Details
Evidence
"restrict any fallback browsing to official OpenAI domains"
"When falling back to web search, restrict to official OpenAI domains (developers.openai.com, platform.openai.com) and cite sources."
No declared tools or file-system permissions in the profile.
MCP Risk
Low
MCP server URL (https://developers.openai.com/mcp) is a known, official OpenAI endpoint; no arbitrary binary execution or hidden instructions in tool descriptions.
Server provides read-only documentation search and fetch operations; no network exfiltration, filesystem mutation, or credential access.
No environment variables or secrets required for MCP authentication in the declared configuration.
MCP tools are named explicitly: `mcp__openaiDeveloperDocs__search_openai_docs`, `mcp__openaiDeveloperDocs__fetch_openai_doc`, `mcp__openaiDeveloperDocs__list_openai_docs`
ForgeCat