registry / forge-harness / 0.1.0-rc16

forge-harness@0.1.0-rc16

Spec-Driven Development harness: single source of truth in .forge/, multi-agent adapters (Claude/Codex/Cursor/Gemini/…), native code graph and deterministic validators. Zero runtime deps.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time attack surface is established. Explicit harness initialization can install a first-party Claude plugin and project-local agent/Git integrations.

Static reason

No blocking static signals were detected.

Trigger

User runs `npx forge-harness init` with the Claude adapter active, or runs `install-plugin`.

Impact

Writes project-local `.forge`, adapter files, and optionally `~/.claude/skills/forge`; no exfiltration or remote execution was confirmed.

Mechanism

User-invoked projection of Forge commands, Claude settings, and Git hooks.

Rationale

Source inspection confirms user-invoked first-party AI-agent extension setup, including a home-directory Claude plugin write. The behavior is not a concrete malicious chain, but merits a warning under the extension lifecycle policy.

Evidence

package.jsonbin/forge.mjstemplate/.forge/scripts/lib/sync-adapters.mjstemplate/.forge/scripts/lib/plugin-build.mjstemplate/.forge/adapters/claude.yamltemplate/.forge/hooks/pre-tool-use/prevent-secrets-leak.sh<target>/.forge/<target>/.claude/settings.json<target>/AGENTS.md<target>/CLAUDE.md<target>/.gitignore<target>/.github/workflows/staging.yml~/.claude/skills/forge<target>/.git/config

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`bin/forge.mjs` auto-installs a Claude plugin under `~/.claude/skills/forge` during `init` when Claude is active.
`template/.forge/scripts/lib/sync-adapters.mjs` materializes tool-specific project control files, including `.claude/settings.json`.
`bin/forge.mjs` explicitly sets project Git `core.hooksPath` to `.forge/hooks/git` when none exists.

Evidence against

`package.json` has no `preinstall`, `install`, `postinstall`, or other lifecycle hook.
CLI actions require explicit `init`, `update`, or `install-plugin` invocation.
Inspected CLI, adapter sync, plugin builder, and hooks contain no network client, download, credential harvesting, or exfiltration path.
Pre-tool hooks enforce naming, worktree location, and secret-leak prevention rather than execute remote payloads.
Git hooks are project-local and preserve an existing custom `core.hooksPath`.

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 31.4 KB of source

Source & flagged code

3 flagged

bin/forge.mjsView file

Lines 168-208javascript

168 const walk = (d) => {

169 let es; try { es = readdirSync(d, { withFileTypes: true }); } catch { return; }

170 for (const e of es) {

171 const p = join(d, e.name);

172 if (e.isDirectory()) walk(p);

173 else if (e.name.endsWith('.md') && !except.includes(e.name)) n++;

174 }

175 };

176 walk(dir);

177 return n;

178 };

179 const specsActive = subdirs(join(forge, 'specs', 'active'));

180 const specsArchived = subdirs(join(forge, 'specs', 'archived'));

181 const productDocs = countMdExcept(join(forge, 'product'), ['CHANGELOG.md']); // template ships only CHANGELOG.md

182 return { specsActive, specsArchived, productDocs, total: specsActive + specsArchived + productDocs };

183}

184

185// Materializa o plugin Claude Code "forge" a partir dos comandos canônicos do pacote

186// (template/.forge/commands), via a MESMA lib que o harness usa (plugin-build.mjs). Global.

187async function installPlugin(out) {

188 const lib = join(TEMPLATE_FORGE, 'scripts', 'lib', 'plugin-build.mjs');

189 const { collectCommands, planForgePlugin, writePlugin } = await import(pathToFileURL(lib).href);

190 const dest = out || join(homedir(), '.claude', 'skills', 'forge');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/forge.mjsView on unpkg · L188

191 const version = pkgVersion();

192 const files = planForgePlugin({ commands: collectCommands(join(TEMPLATE_FORGE, 'commands')), version });

193 writePlugin(dest, files);

194 return { dest, version, count: files.length - 1 };

195}

196

197// Diretórios de MAQUINARIA — substituíveis pelo template novo (overlay aditivo). Nenhum carrega

198// placeholder <PROJECT_*> (verificado). Fora desta lista, tudo é dado do projeto e é preservado:

199// specs/ product/ custom/ evals/ graph/ worktrees/ runners.yaml FORGE.md constitution.md context.md.

200const MACHINERY_DIRS = ['agents', 'commands', 'contracts', 'hooks', 'schemas', 'scripts', 'skills', 'templates', 'rules'];

201

202// Recolhe os arquivos que o overlay tocaria (maquinaria), como pares [rel, srcAbs].

203function machineryFiles(src) {

204 const out = [];

205 for (const d of MACHINERY_DIRS) {

206 const base = join(src, d);

207 if (!existsSync(base)) continue;

208 for (const f of walk(base)) {

template/.forge/hooks/pre-tool-use/check-language-policy.shView file

•path = template/.forge/hooks/pre-tool-use/check-language-policy.sh kind = payload_in_excluded_dir sizeBytes = 2120 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

template/.forge/hooks/pre-tool-use/check-language-policy.shView on unpkg

•path = template/.forge/hooks/pre-tool-use/check-language-policy.sh kind = build_helper sizeBytes = 2120 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/.forge/hooks/pre-tool-use/check-language-policy.shView on unpkg

Source & flagged code

3 flagged · loading source

bin/forge.mjsView file

188const lib = join(TEMPLATE_FORGE, 'scripts', 'lib', 'plugin-build.mjs'); L189: const { collectCommands, planForgePlugin, writePlugin } = await import(pathToFileURL(lib).href); L190: const dest = out || join(homedir(), '.claude', 'skills', 'forge');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/forge.mjsView on unpkg · L188

template/.forge/hooks/pre-tool-use/check-language-policy.shView file

•path = template/.forge/hooks/pre-tool-use/check-language-policy.sh kind = payload_in_excluded_dir sizeBytes = 2120 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

template/.forge/hooks/pre-tool-use/check-language-policy.shView on unpkg

•path = template/.forge/hooks/pre-tool-use/check-language-policy.sh kind = build_helper sizeBytes = 2120 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/.forge/hooks/pre-tool-use/check-language-policy.shView on unpkg

Findings

1 High3 Medium3 Low

HighPayload In Excluded Dirtemplate/.forge/hooks/pre-tool-use/check-language-policy.sh

MediumDynamic Requirebin/forge.mjs

MediumShips Build Helpertemplate/.forge/hooks/pre-tool-use/check-language-policy.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

bin/forge.mjsView file

Lines 168-208javascript

168 const walk = (d) => {

169 let es; try { es = readdirSync(d, { withFileTypes: true }); } catch { return; }

170 for (const e of es) {

171 const p = join(d, e.name);

172 if (e.isDirectory()) walk(p);

173 else if (e.name.endsWith('.md') && !except.includes(e.name)) n++;

174 }

175 };

176 walk(dir);

177 return n;

178 };

179 const specsActive = subdirs(join(forge, 'specs', 'active'));

180 const specsArchived = subdirs(join(forge, 'specs', 'archived'));

181 const productDocs = countMdExcept(join(forge, 'product'), ['CHANGELOG.md']); // template ships only CHANGELOG.md

182 return { specsActive, specsArchived, productDocs, total: specsActive + specsArchived + productDocs };

183}

184

185// Materializa o plugin Claude Code "forge" a partir dos comandos canônicos do pacote

186// (template/.forge/commands), via a MESMA lib que o harness usa (plugin-build.mjs). Global.

187async function installPlugin(out) {

188 const lib = join(TEMPLATE_FORGE, 'scripts', 'lib', 'plugin-build.mjs');

189 const { collectCommands, planForgePlugin, writePlugin } = await import(pathToFileURL(lib).href);

190 const dest = out || join(homedir(), '.claude', 'skills', 'forge');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/forge.mjsView on unpkg · L188

191 const version = pkgVersion();

192 const files = planForgePlugin({ commands: collectCommands(join(TEMPLATE_FORGE, 'commands')), version });

193 writePlugin(dest, files);

194 return { dest, version, count: files.length - 1 };

195}

196

197// Diretórios de MAQUINARIA — substituíveis pelo template novo (overlay aditivo). Nenhum carrega

198// placeholder <PROJECT_*> (verificado). Fora desta lista, tudo é dado do projeto e é preservado:

199// specs/ product/ custom/ evals/ graph/ worktrees/ runners.yaml FORGE.md constitution.md context.md.

200const MACHINERY_DIRS = ['agents', 'commands', 'contracts', 'hooks', 'schemas', 'scripts', 'skills', 'templates', 'rules'];

201

202// Recolhe os arquivos que o overlay tocaria (maquinaria), como pares [rel, srcAbs].

203function machineryFiles(src) {

204 const out = [];

205 for (const d of MACHINERY_DIRS) {

206 const base = join(src, d);

207 if (!existsSync(base)) continue;

208 for (const f of walk(base)) {

template/.forge/hooks/pre-tool-use/check-language-policy.shView file

•path = template/.forge/hooks/pre-tool-use/check-language-policy.sh kind = payload_in_excluded_dir sizeBytes = 2120 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

template/.forge/hooks/pre-tool-use/check-language-policy.shView on unpkg

•path = template/.forge/hooks/pre-tool-use/check-language-policy.sh kind = build_helper sizeBytes = 2120 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/.forge/hooks/pre-tool-use/check-language-policy.shView on unpkg