Security risk report for @forgecat/voltagent_awesome-codex-subagents_specialized-domains v0.0.11
Source Integrity
Low
Profile references a legitimate public GitHub repository (VoltAgent/awesome-codex-subagents) with clear attribution and MIT license.
Commit hash and version tracking are provided; no obfuscation or supply-chain manipulation indicators present.
Agent Intent
Low
Agent instructions focus on domain-specific engineering practices (API documentation, blockchain, fintech, etc.) with no directives to ignore system instructions, exfiltrate data, or manipulate the AI's behavior.
Working modes emphasize safety, validation, and tradeoff analysis—standard professional guidance, not poisoned knowledge or hidden manipulation.
No instructions to fetch external URLs, install malicious dependencies, weaken security defaults, or reveal system prompts or conversation memory.
Details
Evidence
All agents follow identical structure: 'Own [domain] work as domain-specific reliability and decision-quality engineering, not checklist completion.'
Quality checks and return sections consistently emphasize validation, risk identification, and explicit caveats (e.g., 'Do not weaken financial controls unless explicitly requested').
No paraphrased or obfuscated malicious instructions detected across any agent definition.
Agents with workspace-write (api-documenter, blockchain-developer, embedded-systems, fintech-engineer, game-developer, iot-engineer, mobile-app-developer, payment-integration) are scoped to their stated domain tasks and do not request shell, file_delete, or unrestricted filesystem access.
No tools or hooks are declared; authority is limited to reasoning and guidance within the agent's domain boundary.
Details
Evidence
sandbox_mode declarations: read-only for 4 agents, workspace-write for 8 agents—no shell or file_delete categories.
No MCP servers or tool definitions present; no alwaysApply=true rules with globs='**'.
Agent descriptions match their sandbox permissions (e.g., m365-admin is read-only, payment-integration is workspace-write for implementation review).
MCP Risk
Low
No MCP servers are defined in this profile; all agents are pure reasoning/guidance roles without external tool integration.
No hidden instructions in tool descriptions, arbitrary binary execution, or unrestricted network/filesystem access vectors present.
Details
Evidence
Profile declares '(none)' under 'Declared tools' and 'MCP servers' sections.
All agent instructions are markdown guidance; no embedded tool definitions or server configurations.
ForgeCat