Security risk report for @forgecat/voltagent_awesome-codex-subagents_quality-security v0.0.14
Source Integrity
Low
Profile is sourced from a public GitHub repository (VoltAgent/awesome-codex-subagents) with clear attribution and MIT license.
No evidence of typosquatted dependencies, malicious package recommendations, or supply-chain manipulation in the agent instructions.
Agent Intent
Low
All 16 agent instructions are legitimate quality/security review guidance focused on evidence-driven analysis, risk prioritization, and minimal intervention—standard practices for code review, testing, and security auditing.
No instructions to ignore system prompts, exfiltrate credentials, read sensitive files, or manipulate the AI's behavior; no prompt injection, role hijacking, or system-prompt leakage attempts.
Agents describe security review *methodologies* (e.g., penetration-tester, security-auditor) but do not instruct the AI to perform unauthorized attacks or hide its instructions; they are scoped to legitimate code/design review contexts.
Details
Evidence
accessibility-tester: 'verify at least one full user flow with keyboard-only interaction assumptions' — standard accessibility testing guidance.
penetration-tester: 'verify each finding includes attack path, prerequisites, and impact scope' — describes responsible security review, not unauthorized exploitation.
security-auditor: 'Do not claim full security assurance from static review alone unless explicitly requested by the parent agent' — explicitly constrains scope and honesty.
Permissions
Low
Most agents declare sandbox_mode=read-only, limiting file/network write authority to review and analysis tasks.
Two agents (browser-debugger, test-automator) declare workspace-write, which is appropriate for their stated functions (browser debugging, test implementation) and scoped to workspace artifacts, not system files.
No shell, file_delete, or unrestricted network access declared; no alwaysApply=true rules with broad globs.
Details
Evidence
browser-debugger: sandbox_mode=workspace-write — justified for UI debugging and evidence collection.
test-automator: sandbox_mode=workspace-write — justified for test implementation and harness improvements.
All others: sandbox_mode=read-only — appropriate for review-only agents.
MCP Risk
MCP-000Medium
An MCP server is declared pointing to http://localhost:3000/mcp (Chrome DevTools), which involves external network access to a local browser instance and could expose browser session data, cookies, or DOM content to the agent.
The server uses plain HTTP (not HTTPS) on localhost, which is typical for local DevTools bridges but means traffic is unencrypted; the scope of what the browser MCP exposes depends entirely on the server implementation, which is not bundled or audited here.
No hidden instructions were found in tool descriptions, and the localhost target is consistent with the browser-debugger agent's stated purpose, keeping risk at medium rather than high.
Details
Evidence
{"chrome_devtools": {"url": "http://localhost:3000/mcp"}} — external (local) host access via HTTP
browser-debugger.md: 'client-side debugging through a browser MCP server' — declared purpose aligns with MCP server
No tool descriptions with embedded instructions were present in the MCP server definition
ForgeCat