Security risk report for @forgecat/voltagent_awesome-codex-subagents_language-specialists v0.0.11
Source Integrity
Low
Profile is sourced from a known public repository (VoltAgent/awesome-codex-subagents) with MIT license and explicit attribution.
No supply-chain poisoning indicators: no typosquatted dependencies, no hidden package redirects, no backdoored code templates injected into agent instructions.
Agent Intent
Low
Agent instructions describe legitimate language-specialist roles with scoped, framework-specific guidance (Angular, C++, Python, etc.); no prompt-injection phrasing or role-hijack attempts.
Content documents best practices (error handling, transaction safety, type correctness) without instructing the AI to ignore its system prompt, read credentials, or exfiltrate data.
No guidance poisoning: recommendations align with standard industry practices (e.g., 'confirm transaction boundaries', 'verify async cleanup') rather than weakening security defaults or installing persistent biased rules.
Details
Evidence
Example from angular-architect.md: 'verify changed flows across route entry, state update, and rendered output' — describes validation, not manipulation.
Example from python-pro.md: 'confirm exception behavior is explicit and observable to callers' — standard engineering practice, not a malicious instruction.
No instructions to fetch external URLs, install untrusted profiles, or reveal system prompts.
Permissions
Low
Profile declares no tools, MCP servers, or file-system/shell hooks; authority is purely instructional guidance for language-specific code review.
Sandbox mode is set to 'workspace-write' or 'read-only' (sql-pro) — appropriate for code analysis and editing tasks, not excessive.
No alwaysApply rules, glob patterns, or high-risk categories (shell, file_delete) unrelated to the stated purpose.
Details
Evidence
All 26 agent definitions specify model (gpt-5.4) and sandbox_mode only; no tool definitions or permission escalation.
sql-pro explicitly uses 'read-only' mode, reflecting its query-review scope.
MCP Risk
Low
No MCP servers are defined in the profile; all agents are pure instruction-based guidance without external binary execution or network access.
No hidden instructions in tool descriptions, no arbitrary code execution, no unrestricted filesystem or network access.
Profile is self-contained and does not depend on external services or credentials.
Details
Evidence
Profile metadata shows 'Dependencies: None' and no MCP server definitions in the untrusted content.
Agents operate as instructional subagents within Cursor/Claude Code/Codex, not as external processes.
ForgeCat