Forge

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:48 AM UTC
• Version: 1.0.0

Overview

Forge is a legitimate autonomous testing skill, but it gives agents broad power to run services, change code, seed data, and create commits without strong safety boundaries.

Install only if you intentionally want an agent to run project commands, start backends, run migrations, seed data, edit files, and create local commits. Use verify-only first, run on a disposable branch or worktree with non-production data, review forge.config.yaml and discovered commands, and inspect diffs, commits, logs, and memory state after each run.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The changelog describes an Auto-Committer that stages files and creates commits automatically, but the file does not pair that capability with an explicit warning or consent requirement. In an autonomous skill, repository-modifying behavior can surprise users, alter source history, and persist incorrect or unsafe changes if triggered without clear opt-in and visibility.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The changelog states that structured JSON events are written persistently to `.forge/progress.jsonl` without warning users that execution details will be logged locally. Even if intended for observability, persistent logs can capture sensitive filenames, test results, paths, prompts, or operational metadata and remain on disk longer than users expect.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The README explicitly says the skill will 'verify, test, fix, and commit — continuously,' and later names an 'Auto-Committer' agent that stages files and creates commits. Describing autonomous code modification and commits without a prominent warning or explicit consent requirement is dangerous because users may invoke the skill expecting analysis only, while it can alter repository state, create commits, and potentially propagate faulty or unsafe changes at scale.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README documents chaos testing commands and 'controlled failure injection' but provides no safety warning that these actions can disrupt running services, shared environments, seeded data, or dependent systems. In the context of an autonomous multi-agent tool that can run across contexts and real backends, omission of this warning increases the risk of accidental service instability, data corruption, or testing against non-isolated environments.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly says it will create and truncate `.forge/progress.jsonl` and elsewhere instructs agents to write spec files, ADRs, and config-adjacent artifacts into the repository. In an autonomous agent context, modifying tracked files without an upfront, consolidated warning and explicit opt-in is dangerous because it can overwrite user work, introduce unintended changes, and make the tool materially state-changing rather than observational.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill authorizes autonomous bug fixing, staging, committing, and rollback-related git operations, which are powerful state-changing actions on the user's codebase. Without an explicit user warning and opt-in, an agent can silently alter source, create misleading history, or commit unsafe changes that appear validated by the skill's own gate logic.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill performs real backend startup, health checks, migrations, contract snapshot capture, and API-based test-data seeding, but does not present a consolidated warning about privacy, data handling, system impact, or environmental side effects. In practice this can modify databases, start services, hit sensitive endpoints, and store API contract data in memory namespaces without the user's informed approval.

Credential Access

High

• Category: Privilege Escalation

Content

cd ${BACKEND_DIR}

  # 4. Ensure environment is configured
  cp .env.example .env 2>/dev/null || true

  # 5. Build the backend
  ${BUILD_COMMAND}

• Confidence: 84% confidence
• Finding: .env

Session Persistence

Medium

• Category: Rogue Agent

Content

${MIGRATION_COMMAND}

  # 7. Start backend (background)
  nohup ${RUN_COMMAND} > backend.log 2>&1 &
  echo $! > backend.pid

  # 8. Wait for backend to be healthy (up to 60 seconds)

• Confidence: 79% confidence
• Finding: nohup

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.