heating the forge...

small-business-agent-team

Security risk report for @forgecat/small-business-agent-team v0.1.15

Low

Profile is authored by ForgeCat and sourced from the official ForgeCat registry repository (github.com/nota-america/forgecat-agent-profiles).
Static scanner confirms safe — no supply-chain red flags.

Low

Content describes legitimate small-business workflows (finance, sales, customer support, hiring) with no instructions to manipulate the AI, exfiltrate data, or bypass security controls.
All agent instructions emphasize approval gates before external action (money, customer contact, legal documents, HR) — reinforces human oversight rather than weakening it.
Guidance on using underlying skills by exact name and graceful degradation when connectors fail is standard operational practice, not poisoning.

Details

Findings

Invisible characters detected
skills/tax-season-organizer/SKILL.md · SKILL-011
Invisible characters detected
skills/business-pulse/reference/output_template.md · SKILL-011
Invisible characters detected
skills/canva-creator/reference/hubspot-staging.md · SKILL-011
Invisible characters detected
skills/customer-pulse/reference/gotchas.md · SKILL-011
Invisible characters detected
skills/job-post-builder/reference/offer-letter-template.md · SKILL-011
Invisible characters detected
skills/margin-analyzer/reference/examples/retail-boutique.md · SKILL-011
Invisible characters detected
skills/tax-season-organizer/reference/examples/year-end-1099.md · SKILL-011

Evidence

'Never send a customer reply without owner review. Never issue or stage a refund without explicit owner approval…'
'Keep the owner in control. Ask for approval before any action that touches money, customers, public communications, legal documents, hiring, or HR.'
'Do not provide financial or tax advice. Provide operational analysis and recommend CPA review for binding decisions.'

Low

Each agent is scoped to its stated function: finance agent handles cash/invoices/payroll, growth agent handles CRM/campaigns, customer-ops handles support/complaints, people-legal handles hiring/contracts.
No shell, file_write, file_delete, or unrestricted file_mutate permissions declared in the profile itself; MCP servers are external connectors (QuickBooks, HubSpot, Canva, etc.) that are legitimate for their stated purposes.
Authority matches function — no excessive or vague self-expanding rules.

Details

Evidence

Agent descriptions and skill maps are tightly bounded: 'smb-finance-agent' owns 'cash-flow-snapshot, invoice-chase, margin-analyzer…' — not arbitrary tools.
Operating rules explicitly forbid unauthorized action: 'Never initiate payment, refund, invoice send, price update, tax filing, or external message without explicit owner approval.'

MCP-000Medium

Eleven MCP servers are declared, all pointing to well-known vendor-hosted endpoints (Intuit, PayPal, HubSpot, Canva, DocuSign, Slack, Stripe, Square, Google); none are unknown binaries or self-hosted arbitrary servers.
The breadth of connected services (financial transactions, email, legal document signing, social publishing) means a compromised or misconfigured MCP server could have significant blast radius, warranting caution despite the reputable hostnames.
No hidden instructions were found embedded in tool descriptions, and no unrestricted filesystem or arbitrary code execution is declared in the MCP server definitions.

Details

Evidence

MCP config: 'quickbooks': 'https://ai-inc.quickbooks.intuit.com/v1/mcp', 'docusign': 'https://mcp.docusign.com/mcp', 'gmail': 'https://gmailmcp.googleapis.com/mcp/v1' — all vendor-canonical URLs
MCP config: 11 services covering financial data (QuickBooks, Stripe, PayPal, Square), communications (Gmail, Slack), CRM (HubSpot), legal (DocuSign), and file storage (Google Drive)
No tool description fields with embedded instructions were present in the reviewed MCP server definitions.