heating the forge...

@forgecat/orchestra-research_ai-research-skills — Security Risk Report | ForgeCat

orchestra-research_ai-research-skills

Security risk report for @forgecat/orchestra-research_ai-research-skills v0.1.9

SRC-003High

Static scanner flagged source at high level, indicating supply-chain concerns with the profile's origin or dependencies.
The profile pulls content from a GitHub raw URL (forgecat-agent-profiles/main/assets/) and references numerous external pip packages and HuggingFace model downloads, expanding the attack surface.
The breadth of external dependencies (60+ flagged files referencing external tools, APIs, and services) means a compromised upstream package or URL could affect the agent's behavior.

Details

Findings

platforms/claude-code/.claude/skills/lambda-labs-gpu-cloud/references/troubleshooting.md:148
platforms/claude-code/.claude/skills/lambda-labs-gpu-cloud/references/troubleshooting.md:196
skills/ai-research-skills/09-infrastructure/lambda-labs/references/troubleshooting.md:148
skills/ai-research-skills/09-infrastructure/lambda-labs/references/troubleshooting.md:196
Code obfuscation
skills/ai-research-skills/docs/npm-package-plan.md · SKILL-005
System modification
skills/ai-research-skills/09-infrastructure/lambda-labs/references/advanced-usage.md · SKILL-009
Suspicious URLs
skills/ai-research-skills/08-distributed-training/ray-train/references/multi-node.md · SKILL-007
Suspicious URLs
skills/ai-research-skills/13-mlops/mlflow/SKILL.md · SKILL-007
Data exfiltration
skills/ai-research-skills/13-mlops/mlflow/references/deployment.md · SKILL-002
Suspicious URLs
skills/ai-research-skills/13-mlops/mlflow/references/deployment.md · SKILL-007
System modification
skills/ai-research-skills/15-rag/qdrant/references/troubleshooting.md · SKILL-009
Data exfiltration
skills/ai-research-skills/14-agents/autogpt/references/troubleshooting.md · SKILL-002
System modification
skills/ai-research-skills/14-agents/autogpt/references/troubleshooting.md · SKILL-009

INT-000Medium

The autoresearch skill explicitly instructs the agent to operate fully autonomously without asking for user permission ('Do not ask the user for permission or confirmation — use your best judgment and keep moving'), which expands the agent's self-directed authority beyond typical assistant behavior.
The agent-continuity reference instructs setting up a recurring cron job or /loop that injects a prompt every 20 minutes ('Continue autoresearch... Never idle'), constituting a self-perpetuating prompt injection mechanism that keeps the agent running indefinitely without user re-authorization.
No direct credential exfiltration, role hijacking, or 'ignore previous instructions' language was found; the content appears to be a legitimate research orchestration framework, but the autonomous-operation and self-scheduling instructions represent meaningful manipulation of agent behavior boundaries.

Details

Findings

Invisible characters detected
README.md · SKILL-011
Invisible characters detected
skills/ai-research-skills/CONTRIBUTING.md · SKILL-011
Invisible characters detected

PRM-000Medium

The autoresearch skill instructs the agent to create and manage files across a broad workspace structure (research-state.yaml, findings.md, experiments/, paper/, etc.), implying broad file-write authority across the project directory.
The agent-continuity instructions direct the agent to install and invoke cron jobs (via cron.add tool) and use /loop to schedule recurring autonomous actions, which is authority beyond a typical research-assistance role.
The skill routing map references infrastructure tools (Modal, SkyPilot, Lambda Labs) and distributed training across 512+ GPUs, suggesting the agent may be directed to provision and interact with external cloud compute resources autonomously.

Details

Evidence

'Initialize research-state.yaml, research-log.md, and findings.md from templates/. Adapt the workspace as the project evolves'
'Use the cron.add tool to create a recurring job bound to the current chat session'
Skill routing: 'Serverless GPU compute | Modal', 'Multi-cloud orchestration | SkyPilot'

Low

No MCP server definitions are declared in this profile.
No tool descriptions with hidden instructions, arbitrary binary execution, or unrestricted network/filesystem access were identified in the MCP configuration.
Risk from external tool usage (pip packages, HuggingFace downloads) is captured under source/supply-chain rather than MCP risk.

Details

Evidence