Security risk report for @forgecat/voltagent_awesome-codex-subagents_infrastructure v0.0.11
Source Integrity
Low
Profile is sourced from a public GitHub repository (VoltAgent/awesome-codex-subagents) with clear attribution and MIT license.
Version pinning and commit hash (5b7a405, 2026-03-19) provide supply-chain traceability; no suspicious or obfuscated origins detected.
Agent Intent
Low
All 16 agent instructions focus on legitimate infrastructure engineering practices (deployment, Kubernetes, Terraform, incident response, etc.) with no prompt-injection language or role-hijacking attempts.
Instructions consistently emphasize production safety, least-privilege, rollback safety, and evidence-driven decision-making—standard operational best practices, not malicious guidance.
No directives to read credentials, exfiltrate data, hide instructions, install remote payloads, or leak system prompts; no guidance poisoning (typosquatted packages, disabled TLS, persistent biased rules) detected.
Details
Evidence
All agent descriptions state legitimate use cases: 'Use when a task needs [infrastructure domain] review or implementation.'
Repeated safety-first language: 'Favor the smallest defensible recommendation or change that restores reliability, preserves security boundaries, and keeps rollback options clear.'
Quality checks consistently require validation, evidence tagging, and explicit risk disclosure—defensive posture, not offensive manipulation.
Two agents (deployment-engineer, devops-engineer) use workspace-write mode, which is appropriate for their stated functions (deployment workflow changes, CI/CD pipeline edits).
No shell, file_delete, or unrestricted file_write permissions declared; no alwaysApply=true rules with broad globs; authority is scoped to stated infrastructure engineering domains.
devops-engineer: 'sandbox_mode: workspace-write' — justified for 'CI, deployment pipeline, release automation, or environment configuration work.'
All other agents: 'sandbox_mode: read-only' — appropriate for review, analysis, and advisory roles.
MCP Risk
Low
No MCP servers are declared in the profile; no external tool integrations, binary execution, or network access are configured.
Profile is a pure instruction/guidance collection with no dynamic tool loading, arbitrary code execution, or unrestricted filesystem/network access.
Agents are designed to operate on user-provided code/configuration artifacts (Terraform, Kubernetes manifests, Dockerfiles, etc.) without invoking external services.
Details
Evidence
Profile metadata: 'Dependencies: None'
No MCP server definitions in the untrusted_profile_content.
All agents reference static analysis of provided infrastructure code, not external API calls or remote execution.
ForgeCat