Security risk report for @forgecat/yeachan-heo_oh-my-claudecode_agents v0.1.5
Source Integrity
Low
Profile is sourced from a public GitHub repository (Yeachan-Heo/oh-my-claudecode) with MIT license and explicit commit hash (deee3a446dadc9bfea31cdc8b19b00b16718082e).
Registry version 0.1.5 is transparently versioned; original repository URL is documented.
No typosquatted dependencies, attacker-controlled package names, or supply-chain poisoning patterns detected.
Agent Intent
Low
Agent instructions are role-specific, legitimate, and focused on their stated functions (analysis, architecture review, code review, debugging, design, documentation).
No instructions to ignore system prompts, read credentials (~/.ssh, ~/.aws, .env), exfiltrate data, or install remote payloads.
No guidance poisoning: agents recommend standard tools (lsp_diagnostics, git, Bash, WebSearch) and legitimate practices (SOLID principles, security checklists, OWASP Top 10 awareness).
Agents are constrained by disallowedTools (Write/Edit for read-only roles) and explicit scope boundaries; no self-expanding authority or vague role hijacking.
Details
Evidence
analyst.md: 'Read-only: Write and Edit tools are blocked.' Constraints explicitly limit authority.
architect.md: 'You are READ-ONLY. Write and Edit tools are blocked. You never implement changes.' Clear scope boundary.
code-reviewer.md: 'Never approve your own authoring output or any change produced in the same active context; require a separate reviewer/verifier lane for sign-off.' Governance rule, not manipulation.
debugger.md: 'Fix with minimal diff. Do not refactor, rename variables, add features, optimize, or redesign.' Scope constraint, not instruction to hide or exfiltrate.
All agents reference legitimate security practices: 'OWASP Top 10', 'secrets detection', 'SQL/NoSQL injection prevention', 'XSS prevention', 'CSRF protection'—these are defensive, not offensive.
Permissions
Low
Agent tool usage is minimal and aligned with stated functions: Read, Grep, Bash (for git/build commands), lsp_diagnostics, WebSearch/WebFetch for documentation lookup.
No high-risk tool categories (shell_execute with arbitrary commands, file_write/delete, subagent spawning) are requested unconditionally or with alwaysApply=true.
Agents explicitly disallow Write/Edit for read-only roles (analyst, architect, code-reviewer, document-specialist); debugger and designer use Edit only for minimal, scoped fixes.
External consultation (spawning subagents) is optional and gracefully skipped if unavailable; no forced delegation or hidden authority escalation.
Details
Evidence
analyst.md: 'disallowedTools: Write, Edit' — authority is constrained.
code-reviewer.md: 'disallowedTools: Write, Edit' — no mutation authority.
debugger.md: 'Use Edit for minimal fixes (type annotations, imports, null checks).' — scoped, not blanket.
designer.md: 'Use Write/Edit for creating and modifying components.' — scoped to UI implementation, not system-level access.
MCP Risk
Low
No MCP servers are declared in the profile; all tool usage is via standard Claude Code/Cursor/Codex built-in tools (Read, Grep, Bash, lsp_diagnostics, WebSearch, WebFetch).
No hidden instructions in tool descriptions; agent prompts are transparent and role-specific.
No arbitrary binary execution or unrestricted network/filesystem access; Bash usage is limited to git commands, build verification, and read-only environment checks.
Details
Evidence
Profile header: '(none declared)' under 'Declared tools' and 'MCP servers'.
All tool references are standard: 'Use Read to examine', 'Use Grep to search', 'Use Bash with git blame', 'Use lsp_diagnostics', 'Use WebSearch/WebFetch'.
No custom MCP definitions, binary paths, or network endpoints embedded in agent instructions.
ForgeCat