Security risk report for @forgecat/voltagent_awesome-codex-subagents_data-ai v0.0.11
Source Integrity
Low
Profile references a public GitHub repository (VoltAgent/awesome-codex-subagents) with MIT license and clear attribution.
Commit hash and version are explicitly declared, enabling reproducibility and supply-chain traceability.
Agent Intent
Low
Content consists of legitimate agent role definitions and working-mode guidance focused on professional engineering practices (data pipelines, ML systems, database optimization, prompt design).
No instructions to ignore system prompts, exfiltrate credentials, fetch external payloads, or manipulate the AI into unauthorized actions.
Guidance emphasizes safety practices (validation, testing, rollback strategies, observability) rather than weakening security defaults or installing backdoored patterns.
Details
Evidence
All agent descriptions map to standard professional roles (data-engineer, mlops-engineer, postgres-pro, etc.) with clear, bounded scope.
Working-mode sections consistently emphasize 'smallest safe fix', 'validation', 'quality checks', and 'residual risk' — standard engineering discipline, not manipulation.
Example: ai-engineer agent instructs 'verify the changed AI path is reproducible with explicit inputs and expected outputs' and 'confirm structured outputs are validated before downstream use' — security-positive guidance.
Permissions
Low
No tools or MCP servers are declared in this profile; authority is purely instructional guidance for human-directed agent behavior.
Sandbox modes declared (workspace-write, read-only) are appropriate to stated function: data-engineer and ml-engineer agents have workspace-write for implementation work; analyst and optimizer agents have read-only for analysis.
No shell, file_delete, or unrestricted network access is requested; permissions align with professional data/ML engineering scope.
Details
Evidence
Profile declares 'Dependencies: None' and no MCP server definitions.
Sandbox modes match role: 'ai-engineer' (workspace-write) for implementation, 'data-analyst' (read-only) for interpretation, 'database-optimizer' (read-only) for analysis.
MCP Risk
Low
No MCP servers are defined in this profile; no binary execution, network access, or filesystem scope to evaluate.
Profile is purely instructional markdown for agent role definitions and working practices.
Details
Evidence
MCP servers section is empty: '(none)'.
All content is static markdown documentation with no tool definitions or external service integrations.
ForgeCat