Security audit

Forge

Security checks for vulnerabilities and agentic risk

Overview

Forge has a legitimate skill-building purpose, but it automatically adds background jobs and can silently replace its own installed files from GitHub, so it needs user review before installation.

Install only if you are comfortable with Forge creating or changing skill packages, processing files placed in its intake directory, writing run journals, and registering background jobs. Before use, consider disabling the daily self-update, reviewing any generated or repaired skill files before enabling them, and restricting who or what can write to the Mentor intake path.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The README documents an automatic self-update capability that pulls code from GitHub, which expands the skill from local package construction into unattended network access and code replacement. In an agent skill, this creates a supply-chain and remote code execution risk if the upstream repository, update channel, or transport assumptions are compromised.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The setup text says initialization automatically registers a midnight self-update task without warning the user that future executions may access the network and modify installed code. Silent persistence plus hidden modification behavior is dangerous in an autonomous agent context because users may not realize the skill can change itself after installation.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The scheduled tasks table advertises a daily self-update from GitHub but does not include any warning about external network access or automatic code changes. In this skill context, scheduled background updates are more dangerous because the package is described as a core builder/orchestrator skill, so compromise could affect future generated artifacts and workflows.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The self-update flow downloads code from a remote repository and then recursively copies the extracted contents over the local skill directory, with no integrity verification, pinning, or explicit confirmation before overwriting files. In this skill's context, that is more dangerous because the update is designed to run silently and is paired with scheduled automation, so a compromised repo, token, network path, or unexpected tarball contents could silently replace trusted local behavior.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The file mandates persistent journaling of every run to a user-home directory and includes detailed run metadata such as timestamps, model/provider, command, skill identity, and hashed input linkage, but provides no notice, consent mechanism, retention controls, or minimization guidance. In an agent skill that processes potentially sensitive tasks, this creates a real privacy and security risk because operational metadata can accumulate on disk, be accessed by other local processes or users, and enable reconstruction or correlation of user activity over time.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The description embeds very broad trigger phrases such as 'create a new skill', 'build a skill', and 'review this skill', which are common user requests and can cause accidental or overly broad routing of tasks to this skill. Because this skill can design, build, repair, and validate installable skill packages, unintended invocation could let it act on requests outside the user's intent and produce or modify artifacts with elevated operational consequences.

Static analysis

No suspicious patterns detected.