heating the forge...

@forgecat/small-business-agent — Security Risk Report | ForgeCat

small-business-agent

Security risk report for @forgecat/small-business-agent v0.1.1

Low

Static scanner flagged low-level source risk; profile is authored by ForgeCat (declared in README.md) and references a known upstream source (@forgecat/anthropics_knowledge-work-plugins_small-business).
No evidence of typosquatted, attacker-controlled, or backdoored dependencies; all MCP servers reference legitimate, well-known SaaS platforms (QuickBooks, PayPal, HubSpot, Slack, Stripe, Square, Gmail, Google Calendar, Google Drive, Canva, DocuSign).
Profile does not instruct installing arbitrary packages, fetching unsigned code, or using alternative registries; supply-chain risk is minimal.

Low

Profile contains no instructions to ignore system prompts, read credentials from ~/.ssh/~/.aws/.env, exfiltrate data, hide instructions, or install remote payloads.
No guidance poisoning detected: profile does not instruct weakening security defaults (TLS, logging), using typosquatted packages, or embedding backdoored code templates; it recommends legitimate, standard small-business workflows (cash flow, payroll, CRM, hiring).
Profile explicitly requires owner approval before external actions touching money, customers, legal documents, hiring, or HR — this is a security-positive constraint, not a manipulation attempt.

Details

Findings

Invisible characters detected
skills/tax-season-organizer/SKILL.md · SKILL-011
Invisible characters detected
skills/business-pulse/reference/output_template.md · SKILL-011
Invisible characters detected
skills/canva-creator/reference/hubspot-staging.md · SKILL-011
Invisible characters detected
skills/customer-pulse/reference/gotchas.md · SKILL-011
Invisible characters detected
skills/job-post-builder/reference/offer-letter-template.md · SKILL-011
Invisible characters detected
skills/margin-analyzer/reference/examples/retail-boutique.md · SKILL-011
Invisible characters detected
skills/tax-season-organizer/reference/examples/year-end-1099.md · SKILL-011

Evidence

AGENTS.md: 'Do not take external action that affects money, customers, legal documents, hiring, HR, or public communications without explicit owner approval.'
smb-finance-agent.md: 'Never initiate payment, refund, invoice send, price update, tax filing, or external message without explicit owner approval.'
smb-customer-ops-agent.md: 'Never send a customer reply without owner review. Never issue or stage a refund without explicit owner approval.'

PRM-003Medium

The smb-chief-of-staff agent declares the 'Agent' (subagent) tool in addition to Read/Write/Edit/Grep/Glob, enabling recursive agent delegation — this is broader than a typical single-purpose skill and warrants medium scrutiny.
All five department agents use sandbox_mode: workspace-write with Write and Edit tools, granting persistent file mutation authority across workspace docs; this is consistent with the stated purpose but represents meaningful file-system authority.
Two lifecycle hooks (smb-routing-nudge.js, smb-stop-checkpoint.js) are referenced but have no matched tool declarations per the static scanner, creating a gap where hook behavior cannot be fully audited from the reviewed content.

Details

Findings

Evidence

MCP-000Medium

Eleven external MCP servers are declared, spanning financial (QuickBooks, PayPal, Stripe, Square), CRM (HubSpot), communication (Gmail, Slack, Google Calendar), document signing (DocuSign), and file storage (Google Drive) — a very broad set of sensitive service integrations for a single profile.
All server URLs resolve to known official vendor endpoints with no hidden instructions or arbitrary binary execution detected in tool descriptions.
The breadth of access (financial transactions, email, calendar, legal documents, CRM records) means a compromised or misconfigured MCP server could expose highly sensitive business data; the Slack OAuth clientId being hardcoded in the profile config is a minor but concrete credential exposure.

Details

Evidence

11 MCP servers declared including 'gmail', 'docusign', 'stripe', 'quickbooks', 'paypal' (mcpServers config)
'clientId': '1601185624273.8899143856786' hardcoded in Slack MCP oauth config
All URLs are official vendor domains (googleapis.com, intuit.com, paypal.com, hubspot.com, etc.) — no unknown hosts