heating the forge...

@forgecat/voltagent_awesome-codex-subagents_developer-experience — Security Risk Report | ForgeCat

voltagent_awesome-codex-subagents_developer-experience

Security risk report for @forgecat/voltagent_awesome-codex-subagents_developer-experience v0.0.11

Low

Profile is sourced from a public GitHub repository (VoltAgent/awesome-codex-subagents) with clear attribution and commit hash.
MIT license is declared and verifiable; no supply-chain obfuscation or hidden dependencies.
No external URLs, package fetches, or dynamic code loading are instructed in the profile content.

Low

Content describes legitimate developer-experience agent roles (build, CLI, dependency, documentation, refactoring, etc.) with clear, scoped responsibilities.
No instructions to ignore system prompts, read credentials, exfiltrate data, or perform privilege escalation.
No guidance poisoning: recommendations are standard practices (incremental refactoring, phased upgrades, behavior preservation) without typosquatted packages or security-weakening defaults.
All agent instructions emphasize safety, validation, and minimal intervention—opposite of malicious guidance.

Details

Evidence

Each agent file contains working mode, focus areas, and quality checks that prioritize safety and evidence-backed decisions.
Example: 'Prioritize the smallest practical change or recommendation that reduces friction, preserves safety, and improves day-to-day delivery speed' (repeated across all agents).
Example: 'Do not recommend full build-system migration for a scoped failure unless explicitly requested' (build-engineer.md)—constrains scope, does not expand authority.

Low

No tools or MCP servers are declared in the profile; agents are role definitions only.
Sandbox modes are appropriately scoped: 'workspace-write' for agents that modify code (build, CLI, dependency, MCP, PowerShell, refactoring, Slack, tooling); 'read-only' for analysis-only agents (DX optimizer, git-workflow, legacy-modernizer).
Authority matches stated function: build-engineer handles build pipelines, cli-developer handles CLI UX, etc.—no excessive or unrelated permissions.

Details

Evidence

sandbox_mode: workspace-write (build-engineer, cli-developer, dependency-manager, documentation-engineer, mcp-developer, powershell-module-architect, powershell-ui-architect, refactoring-specialist, slack-expert, tooling-engineer)
sandbox_mode: read-only (dx-optimizer, git-workflow-manager, legacy-modernizer)
No file_delete, shell, or unrestricted network permissions declared.

Low

No MCP servers are defined in this profile; it is a collection of agent role definitions only.
No tool descriptions, binary execution, or network access configurations are present.
Profile relies on platform-native models (gpt-5.3-codex-spark, gpt-5.4) without external integrations.

Details

Evidence

Profile header: 'Dependencies: None'
No MCP server definitions in untrusted_profile_content.
All agents reference only model selection and sandbox mode, not external tool wiring.