Security risk report for @yoochankim/yc-agent-base v0.8.0
Source Integrity
Low
Profile is self-contained within ForgeCat; no external package dependencies, typosquatted modules, or attacker-controlled repositories are declared.
References to external tools (archify, diagram-design, Aside, Playwright) are documented as optional integrations with installation guidance, not hidden injections.
GitHub sync script uses standard git operations with no suspicious remote URLs or backdoored templates.
Agent Intent
Low
Content is a shared operational rulebook for AI agents — communication norms, memory management, safety constraints, and procedural checklists.
No instructions to ignore system prompts, exfiltrate credentials, read ~/.ssh/~/.aws/.env, or hide/deny the agent's own instructions.
No guidance poisoning: does not instruct weakening security defaults, installing backdoored code, or systematically steering outputs toward attacker goals.
References to 'memory', 'learn', 'curation' are legitimate session-state management and knowledge consolidation — not prompt injection or model poisoning.
Details
Findings
Invisible characters detected
AGENTS.md · SKILL-011
Invisible characters detected
skills/yc-memory-curation/SKILL.md · SKILL-011
Evidence
'Never exfiltrate private data' · 'Don't run destructive commands without confirmation' · 'Don't share owner's personal information'
'자격증명 파일의 내용을 출력하지 않는다' (Do not print credential file contents)
Extensive procedural documentation on when to ask permission, what to verify before acting, and how to record decisions — all defensive.
Permissions
Low
Profile declares no tools or MCP servers; it is pure markdown guidance.
Permissions are delegated to downstream agent implementations (Frogg, Bee, Ant, etc.), each with their own tool configs.
Guidance explicitly constrains authority: 'Ask first' for emails, messages, public posts, anything leaving the machine; 'Do freely' for file reads and workspace exploration.
External actions (Aside browser, GitHub sync) are gated by explicit approval rules and environment checks.
Details
Evidence
'Ask first: Sending emails, messages, or public posts · Anything that leaves the machine · Anything you're uncertain about'
'Do freely: Read files, explore, organize, search the web · Work within this workspace'
Aside skill: 'Full access는 파일 읽기·쓰기 범위만 넓힌다' (Full access only widens file scope, not credential access)
MCP Risk
Low
No MCP servers are defined in this profile.
Profile is a base rulebook; MCP definitions belong to derived agent profiles (Frogg, Bee, Ant, etc.).
References to external tools (Aside, Playwright, archify, diagram-design) are optional integrations documented with installation paths, not embedded MCP definitions.
Details
Evidence
'MCP servers (untrusted data): (none)'
External tools are referenced as optional skills with explicit installation commands, not auto-loaded or hidden.
Aside and Playwright are invoked via CLI with explicit permission flags and session management.
ForgeCat