heating the forge...

@forgecat/openai_skills_yeet — Security Risk Report | ForgeCat

openai_skills_yeet

Security risk report for @forgecat/openai_skills_yeet v0.0.10

Low

Profile attributes (author, repository, commit hash, license) are traceable to a legitimate public source (OpenAI skills repository).
Version and platform metadata are consistent with a curated, published skill.

Low

The skill provides explicit, legitimate instructions for a well-defined Git/GitHub workflow (stage, commit, push, PR) using standard CLI tools.
No instructions to read credentials, exfiltrate data, ignore system prompts, or execute remote payloads.
No guidance poisoning: the skill recommends standard tools (git, gh) and does not plant malicious knowledge or weaken security defaults.

Details

Evidence

Skill description: 'Use only when the user explicitly asks to stage, commit, push, and open a GitHub pull request in one flow using the GitHub CLI (`gh`).'
Workflow steps are transparent: `git status`, `git add -A`, `git commit`, `git push`, `gh pr create` — all standard, auditable operations.
Prerequisites explicitly require authentication checks: 'Require authenticated `gh` session. Run `gh auth status`. If not authenticated, ask the user to run `gh auth login`.'

PRM-000Medium

The skill implicitly requires shell/command execution authority to run git and gh CLI commands, which is not explicitly declared in the profile's tool list.
The workflow includes conditional logic (checks, retries, branch creation) that assumes broad shell access; scope is narrower than 'arbitrary shell' but broader than a single, isolated operation.
Authority is justified by the stated purpose (Git workflow automation) but the lack of explicit tool declarations makes the permission boundary unclear.

Details

Evidence

Workflow instructions: `git checkout -b`, `git add -A`, `git commit -m`, `git push -u`, `gh pr create` — all require shell execution.
Conditional retry logic: 'If git push fails due to workflow auth errors, pull from master and retry the push' — assumes ability to run multiple git commands.
No explicit tool declarations in the profile to bound this authority.

Low

No MCP servers are defined in the profile.
The skill relies on standard, user-installed CLI tools (git, gh) rather than custom MCP binaries.
No hidden instructions or arbitrary binary execution vectors.

Details

Evidence

MCP servers section: (none)
Dependencies section: 'None'
Prerequisites reference only standard CLI tools: `gh --version`, `gh auth status`, `gh auth login`.