forge

SUSPICIOUS: the core retrospective purpose matches reading session logs and writing recap docs, but the skill’s footprint is broader than necessary. Main concerns are executing unverifiable local helper scripts, broad access to sensitive local conversation logs, and autonomous git rebase/commit/push actions. Data flows do not show clear credential theft or malicious exfiltration, so this is high-risk/vulnerable rather than confirmed malware.

This module is a QA test runner but it includes high-risk functionality: it executes arbitrary JavaScript from the provided spec via page.evaluate(step.expression) and page.evaluate(assertion.script), and it can intercept/fulfill/abort network routes based on spec input. If an attacker can control the spec or run module, they can execute arbitrary code in the browser context and potentially perform data theft/exfiltration or sabotage test/application behavior. It also captures console errors/URLs/stack traces and writes them to disk, which can retain sensitive data. No explicit backdoor/malware routines are present in this snippet, but the dynamic execution and network mocking make it security-sensitive.

SUSPICIOUS：编排目标与本地文件/git操作总体一致，未见外部下载、凭证收集或明确外传，因而不像恶意窃密 skill。主要风险在于通过 Agent 调用多个未验证的 forge-* 子 skill，形成中等强度的传递信任与自动执行风险；若这些子 skill 不受信，整条流水线可继承其风险。