Forge

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:09 AM UTC
• Version: 1.0.0

Overview

Forge is a disclosed autonomous test-and-fix skill, but it gives the agent broad authority to run project commands, modify code, persist learned patterns, and commit changes with insufficient scoping and safeguards.

Install only in a disposable branch or isolated test environment. Review any forge.config.yaml first, pin or preinstall external tooling instead of using @latest, verify .env and backend targets are non-production, and disable or closely supervise auto-fix, auto-commit, persistent memory reuse, migrations, seeding, and background services.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:193
• Finding: Mutable Remote Package Is Downloaded and Executed Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 193-199 **Vulnerability Type**: Unpinned remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash # Verify API spec matches running API (if OpenAPI/Swagger available) curl -s http://localhost:${BACKEND_PORT}/${OPENAPI_ENDPOINT} > /tmp/live-spec.json # Store contract snapshot for regression detection npx @claude-flow/cli@latest memory store \ --key "contract-snapshot-$(date +%s)" \ --value "$(cat /tmp/live-spec.json | head -c 5000)" \ --namespace forge-contracts ``` The same mutable `npx @claude-flow/cli@latest` execution pattern is used repeatedly elsewhere in `SKILL.md`, including swarm initialization, memory operations, hooks, and neural training. ### Technical Analysis The skill instructs the agent to execute `@claude-flow/cli` through `npx` using the mutable `latest` distribution tag. If the package is not already available locally, `npx` can download and execute it automatically. The `latest` tag does not identify a fixed, previously audited artifact and can resolve to different package contents after the skill itself has been reviewed. No exact version, package-lock entry, integrity hash, vendored artifact, or trusted installation step constrains the code that will execute. Consequently, compromise of the package, its publishing account, its dependency graph, or the package registry can change the effective executable payload without any modification to this project. This is primarily remote payload retrieval and execution. It also creates a supply-chain risk because the downloaded executable receives the permissions of the user running the agent. ### Attack Path 1. An attacker compromises the `@claude-flow/cli` package, a transitive dependency, or an account authorized to publish it. 2. The attacker publishes a malicious version and assigns it to the `latest` tag. 3. A user invokes Forge in a project environment. 4. Forge follows the inst ...[truncated 1056 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version. 2. Record the package and all transitive dependencies in a lockfile with integrity metadata. 3. Install dependencies during a separate, explicit setup phase rather than allowing runtime download and execution. 4. Use `npm ci --ignore-scripts` where compatible, and explicitly review any required lifecycle scripts. 5. Verify the downloaded package against a trusted checksum, signature, or provenance attestation. 6. Require user confirmation before the first installation or execution of an external CLI. 7. Run the CLI in a sandbox with restricted filesystem access, minimal environment variables, and denied outbound network access unless specifically required. 8. Prefer a locally vendored and reviewed tool where reproducible installation cannot be guaranteed. ]]>

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:566
• Finding: Untrusted Repository-Derived Fix Patterns Can Poison Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 566-600 **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: High ### Vulnerable Code ```text 1. Retrieve failure analysis from memory 2. For each failure, apply fix using confidence-tiered approach: PLATINUM (>= 0.95 confidence): - Auto-apply the stored fix pattern immediately - No review needed GOLD (>= 0.85 confidence): - Auto-apply the stored fix pattern - Flag in commit message for awareness SILVER (>= 0.75 confidence): - Read the failing test file and source file - Apply suggested fix with extra verification - Run targeted test before proceeding BRONZE or NO PATTERN: - Read the failing test file - Read the source file causing the failure - Implement fix from first principles - Use defensive patterns appropriate to the test framework 3. After fixing, identify affected context: - Check dependency graph for cascade impacts - Flag dependent contexts for re-testing 4. Store the fix pattern with initial confidence: npx @claude-flow/cli@latest memory store \ --key "fix-[error-type]-[hash]" \ --value '{"pattern":"[fix]","confidence":0.75,"tier":"silver","applied":1,"successes":0}' \ --namespace forge-patterns 5. Signal Test Runner to re-run affected tests 6. Signal Quality Gate Enforcer to check all 7 gates ``` Confidence is subsequently increased after successful test cycles, allowing stored patterns to reach the Platinum tier and be applied without review. ### Technical Analysis The skill persists fix patterns derived from repository source, test failures, stack traces, and agent-generated analyses. These inputs may be attacker-controlled when Forge is run against an untrusted repository. The stored records are placed in the generic `forge-patterns` namespace without documented isolation by repository identity, revision, owner, framework version, or trust level. A test result only demonstra ...[truncated 2108 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Scope every memory namespace to a cryptographic repository identity, owner, remote URL, revision, and relevant framework version. 2. Disable cross-project reuse by default. Require explicit user approval before importing patterns from another repository. 3. Record immutable provenance for each pattern, including source repository, commit, files, test evidence, authoring agent, and creation time. 4. Treat repository-derived patterns as untrusted data rather than instructions. 5. Prohibit automatic promotion to a no-review tier solely from repeated test success. 6. Require human review, security analysis, and signed approval before any pattern becomes eligible for automatic application. 7. Validate patterns against policy rules that reject changes affecting authentication, authorization, secret handling, command execution, dependency installation, or security controls. 8. Provide expiration, deletion, quarantine, and revocation mechanisms for poisoned patterns. 9. Use independent tests not supplied by the source repository before increasing confidence. 10. Display the complete proposed patch and pattern provenance before application in another project. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:145
• Finding: Repository-Controlled Configuration Commands Are Interpolated Directly Into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 145-176 **Vulnerability Type**: Command injection through untrusted project configuration **Risk Level**: Critical ### Vulnerable Code ```bash # 1. Read project config or auto-discover backend settings # 2. Check if backend is already running curl -s http://localhost:${BACKEND_PORT}/${HEALTH_ENDPOINT} || { echo "Backend not running. Starting..." # 3. Navigate to backend directory cd ${BACKEND_DIR} # 4. Ensure environment is configured cp .env.example .env 2>/dev/null || true # 5. Build the backend ${BUILD_COMMAND} # 6. Run database migrations (if applicable) ${MIGRATION_COMMAND} # 7. Start backend (background) nohup ${RUN_COMMAND} > backend.log 2>&1 & echo $! > backend.pid # 8. Wait for backend to be healthy (up to 60 seconds) for i in {1..60}; do if curl -s http://localhost:${BACKEND_PORT}/${HEALTH_ENDPOINT} | grep -q "ok\|healthy\|UP"; then echo "Backend healthy on port ${BACKEND_PORT}" break fi sleep 1 done } ``` The values are obtained from auto-discovery or a repository-provided `forge.config.yaml`, which supports fields such as `buildCommand`, `migrationCommand`, and `runCommand`. ### Technical Analysis The skill treats command strings supplied by project configuration as executable shell syntax. Variables such as `BUILD_COMMAND`, `MIGRATION_COMMAND`, `RUN_COMMAND`, and `BACKEND_DIR` are interpolated directly into a shell script without an executable allowlist, structured argument separation, escaping, validation, sandboxing, or user confirmation. A malicious repository can therefore place shell metacharacters, command substitutions, redirections, pipelines, or additional commands in these fields. Even a quoted implementation would remain unsafe if it ultimately evaluates the value as a shell command rather than treating the executable and each argument as separate data. This behavior occurs in the mandatory backend set ...[truncated 1728 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat all repository configuration as untrusted input. 2. Replace free-form command strings with structured fields containing an executable identifier and an array of arguments. 3. Invoke processes directly without a shell, such as with an API equivalent to `execFile(executable, args, { shell: false })`. 4. Allowlist supported build, migration, and runtime tools and reject unknown executables. 5. Reject shell metacharacters, command substitution, redirection, pipelines, newlines, and absolute paths outside approved directories. 6. Canonicalize `BACKEND_DIR` and verify that it remains within the target repository before changing directories. 7. Display the fully resolved executable and argument list and require explicit user approval before running repository-defined commands. 8. Run project builds in an isolated container or sandbox with a read-only host filesystem, minimal mounted directories, scrubbed environment variables, and restricted networking. 9. Do not automatically copy environment templates into active `.env` files without review. 10. Perform trust verification before Phase 0 and never rely on later security gates to validate commands that have already executed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (45)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill starts backend services, copies environment files, runs migrations, and seeds test data against a real backend without a strong up-front user warning. In the wrong environment, this can alter databases, consume secrets from local env files, or affect non-test systems if discovery/config points to them.

Credential Access

High

• Category: Privilege Escalation

Content

cd ${BACKEND_DIR}

  # 4. Ensure environment is configured
  cp .env.example .env 2>/dev/null || true

  # 5. Build the backend
  ${BUILD_COMMAND}

• Confidence: 88% confidence
• Finding: Automatically copying `.env.example` to `.env` and then building/running the backend can activate credentials, service endpoints, or security-sensitive configuration without user review. In many repos, `.env` may influence database targets, third-party integrations, or test keys, causing accidental credential use or environment confusion.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The changelog documents an agent that can apply fixes and create commits automatically, but it does not warn users that invoking the skill may modify repository contents. In an autonomous coding skill, silent write/commit behavior can cause unintended code changes, branch contamination, or accidental persistence of flawed or unsafe edits, especially when users may assume analysis-only behavior.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documented confidence-tiered fix system allows some fixes to be auto-applied immediately, which creates a direct path for autonomous source modification without clear consent or review safeguards. In this skill context, that is more dangerous because the system is explicitly designed for repeated autonomous fix loops, increasing the chance of widespread unintended changes.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README prominently describes an autonomous system that can fix and commit code continuously, but it does not warn users up front that invoking the skill may modify source files and create commits automatically. In an agentic coding context, missing disclosure materially increases the chance of unintended repository modification, especially when users may treat a README quick start as safe to run verbatim.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The quick start and invocation sections advertise autonomous and chaos modes without any caution that these modes may change code, execute broad test suites, seed data, or intentionally inject failures. Because users are encouraged to run concise commands directly, the lack of warnings is dangerous in this skill context: it increases the risk of accidental service disruption, destructive test activity, or unintended code changes across multiple contexts.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The architecture diagram includes an automatic `Commit` step as part of the core loop, yet there is no adjacent warning that version-control history may be altered without careful user review. In a tool positioned as autonomous and continuous, undocumented auto-commit behavior can lead to irreversible or hard-to-audit changes being recorded and propagated unintentionally.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Session Persistence

Medium

• Category: Rogue Agent

Content

${MIGRATION_COMMAND}

  # 7. Start backend (background)
  nohup ${RUN_COMMAND} > backend.log 2>&1 &
  echo $! > backend.pid

  # 8. Wait for backend to be healthy (up to 60 seconds)

• Confidence: 85% confidence
• Finding: Starting the backend with `nohup ... &` and persisting a PID/background log creates a long-lived process outside the immediate task lifecycle. That can leave services running unintentionally, preserve access to test endpoints, or keep sensitive logs on disk after the analysis run completes.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The skill repeatedly invokes `npx @claude-flow/cli@latest`, which fetches and executes the latest remote package version at runtime. That creates a supply-chain execution path where a compromised upstream package or malicious update can run arbitrary code during testing, memory storage, hooks, training, or orchestration.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Seed test data through REAL API — adapt to your project's seeding endpoint
curl -X POST http://localhost:${BACKEND_PORT}/${SEED_ENDPOINT} \
  -H "Content-Type: application/json" \
  -H "${TEST_AUTH_HEADER}" \
  -d '${SEED_PAYLOAD}'

• Confidence: 92% confidence
• Finding: The test-data seeding step transmits arbitrary `${SEED_PAYLOAD}` to a live backend endpoint using real authentication headers. In context this is intended functionality, but it is still dangerous because the skill can send state-changing requests to whatever backend configuration resolves, potentially impacting real data or leaking sensitive fixtures.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This `npx @claude-flow/cli@latest swarm init` command executes an unpinned remote package at runtime. Because it initializes agent orchestration, compromise of the package could immediately lead to arbitrary command execution and broad repository impact.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This unpinned `npx @claude-flow/cli@latest memory search` call allows remote code execution through package resolution each time the skill searches stored patterns. The repeated use increases attack surface because many workflow phases depend on that package.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The skill uses `npx @claude-flow/cli@latest memory retrieve`, again executing a mutable external package at runtime. A malicious release could exfiltrate repository data, tamper with memory results, or alter later autonomous decisions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This unpinned CLI invocation for loading confidence tiers creates the same supply-chain execution risk as the other `@latest` commands. Because the result influences auto-apply fix behavior, compromise could steer subsequent code modifications.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The skill fetches `@claude-flow/cli@latest` to search defect predictions, allowing mutable upstream code execution in a high-trust path. An attacker controlling that package could bias test order, manipulate analysis data, or run arbitrary commands.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The spec verifier stores results using `npx @claude-flow/cli@latest memory store`, which executes unpinned remote code from inside an autonomous agent. Since this occurs in the background and stores workflow state, a compromised CLI could silently tamper with downstream decisions or leak data.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

CONSTRAINTS:
    - NEVER generate specs for code you haven't read
    - NEVER assume UI elements exist without checking implementation
    - NEVER create scenarios that duplicate existing coverage
    - NEVER modify existing test files — only spec files

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This unpinned `memory search` invocation inside Test Runner exposes test execution to supply-chain compromise. Because it precedes parsing and storing failures, malicious code could falsify results or access test artifacts.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The Test Runner stores parsed results via `npx @claude-flow/cli@latest memory store`, creating another remote execution point in a trusted automation flow. Attackers could alter stored failures to induce unsafe fixes or hide malicious behavior.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The Failure Analyzer uses an unpinned external CLI to search fix patterns, which could let compromised upstream code influence root-cause analysis and recommended changes. This is especially dangerous because it directly feeds an autonomous code-fixing agent.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This `memory store` command relies on `npx @claude-flow/cli@latest` during failure analysis, preserving the same runtime supply-chain risk. It also enables tampering with analysis artifacts that determine what files get changed.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The Bug Fixer stores fix patterns through an unpinned remote CLI, creating a path for arbitrary code execution in the most privileged phase: code modification. A compromised package could inject malicious edits while appearing to be part of normal repair automation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

ACCEPTANCE:
    - Every applied fix has a targeted test re-run result
    - Zero fixes without verification
    - Fix pattern stored with initial confidence score
    - Cascade impacts identified and flagged for re-testing`,
  subagent_type: "coder",

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.