heating the forge...

@forgecat/xixu-me_skills — Security Risk Report | ForgeCat

xixu-me_skills

Security risk report for @forgecat/xixu-me_skills v0.1.2

SRC-010High

Static scanner flagged danger: profile claims to package upstream `xixu-me/skills` from GitHub but provides no verifiable link to the source repository or commit hash.
README states 'Original repository: https://github.com/xixu-me/skills/tree/main/skills' but does not include a version pin, commit SHA, or integrity check; the profile version (0.1.2) is not tied to a specific upstream release.
Skill content (userscripts, GitHub Actions, OpenClaw, LiteLLM, Xdrop, Xget) appears to be original guidance rather than direct copies from the claimed upstream, raising questions about whether this is a faithful repackaging or a modified derivative without clear provenance.
No license file or SPDX identifier is included in the profile itself; the README claims MIT license from source but does not bundle or link the actual license text.

Details

Findings

Suspicious URLs
skills/use-my-browser/README.md · SKILL-007
Suspicious URLs
skills/use-my-browser/README.zh.md · SKILL-007
Suspicious URLs
skills/use-my-browser/README.zh.md · SKILL-007
Suspicious URLs
skills/openclaw-secure-linux-cloud/references/REFERENCE.md · SKILL-007
System modification
skills/openclaw-secure-linux-cloud/references/REFERENCE.md · SKILL-009
Suspicious URLs
skills/secure-linux-web-hosting/references/nginx-patterns.md · SKILL-007
Suspicious URLs
skills/secure-linux-web-hosting/references/workflow-map.md · SKILL-007
System modification
skills/xget/references/REFERENCE.md · SKILL-009

Low

Skill content is educational and advisory in nature—it documents legitimate tools (Tampermonkey, GitHub Actions, OpenClaw, LiteLLM, Xdrop, Xget) and best practices without instructing the AI to perform malicious actions.
References to security hardening (SSH keys, firewalls, token auth, sandboxing) are defensive guidance, not instructions to weaken security or exfiltrate data.
No instructions to read credentials, ignore system prompts, install remote payloads, or hide instructions; no guidance poisoning that would steer future outputs toward attacker goals.

Details

Evidence

develop-userscripts SKILL.md: 'Declare the smallest permission surface that fits the task' and 'Prefer portable patterns' are security-conscious recommendations.
openclaw-secure-linux-cloud SKILL.md: 'Default to a private control plane' and 'Treat the OpenClaw gateway as a private control plane, not a public-first web service' are hardening directives.
github-actions-docs SKILL.md: 'Prefer pages under docs.github.com as the source of truth' and 'Treat repo-specific CI debugging as a documentation question' are routing guidance, not manipulation.

Low

Profile declares no tools or MCP servers; it is a collection of markdown skill definitions and reference documentation.
Skill descriptions are advisory and do not request file_write, file_delete, shell, or other high-risk tool categories; they guide the AI to recommend legitimate tools and practices to the user.
Authority is scoped to information retrieval and documentation routing (e.g., 'link to GitHub docs', 'explain OpenClaw hardening'), not to system-level or user-data access.

Details

Evidence

No 'tools' or 'mcp_servers' section in the profile.
Skill descriptions use phrases like 'Use when users ask...' and 'route to official docs', indicating advisory scope.
References to external services (GitHub, OpenClaw, Xdrop) are for documentation lookup, not for granting the AI direct access to those systems.

Low

No MCP servers are defined in the profile.
Skill content does not embed hidden instructions in tool descriptions or request arbitrary binary execution.
References to external tools (Podman, nftables, Git, curl) are in example commands and documentation, not in MCP server definitions.

Details

Evidence