ClawHub
Back to skill

Security audit

Superpowers Brainstorming

Security checks for vulnerabilities and agentic risk

Overview

This is a design-workflow skill with no executable payload, but it broadly forces approval, repository commits, and a specific follow-up skill before implementation.

Install only if you intentionally want a mandatory design-first workflow. Expect it to slow direct implementation, write spec files into the repository, commit those files, and steer the agent to a specific follow-up planning skill; consider requiring explicit approval before any file write, git commit, or downstream skill invocation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:17
Finding

Mandatory Workflow and Skill-Selection Hijacking

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–20, 26–37, and 103–116
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Instruction Excerpts

The following English translations preserve the meaning of the relevant instructions:

text
Before invoking any implementation skill, writing any code, setting up any
project, or taking any implementation action, the design must first be
presented and approved by the owner.

Every project must follow this process, regardless of perceived complexity.
text
Complete each task in this order:

1. Explore the project context.
2. Offer a visualization companion when applicable.
3. Ask clarification questions one at a time.
4. Present two or three approaches.
5. Present the design and obtain approval.
6. Write the design document and commit it.
7. Review the specification.
8. Require the owner to review the written specification.
9. Transition to implementation by invoking superpowers-writing-plans.

The endpoint is invoking writing-plans. Do not invoke any other
implementation skill.
text
Wait for the owner to respond. If changes are requested, modify the
specification and repeat the review process. Only after owner approval may
execution continue.

Invoke superpowers-writing-plans to create the implementation plan.
Do not invoke any other skill. writing-plans is the next step.

Technical Analysis

The Skill does not limit its brainstorming guidance to cases where the user explicitly requests that workflow. Instead, it declares a mandatory gate for every broadly defined creative task and prohibits implementation until its own approval process has been completed.

It also claims exclusive control over subsequent skill selection by requiring the Agent to invoke superpowers-writing-plans and forbidding all other implementation skills. This changes the Agent's active workflow ...[truncated 2211 chars]

Remediation
View remediation

Remediation Suggestions

  1. Restrict activation to explicit user requests for brainstorming or design assistance rather than automatically applying it to all creative work.
  2. Replace absolute directives such as “must,” “every project,” and “do not invoke any other skill” with optional recommendations subordinate to the current user request and system policy.
  3. Remove exclusive downstream skill routing. Present superpowers-writing-plans as an optional next step and obtain explicit user consent before invoking it.
  4. Require separate, explicit authorization before creating files, modifying the repository, or running git commit.
  5. Permit abbreviated or skipped workflows when the user has already supplied an approved design, requests direct implementation, or is performing a trivial and well-scoped change.
  6. State clearly that the Skill cannot override higher-priority instructions, the user's current objective, security controls, or tool-use restrictions.
  7. Add a non-mutating default mode in which brainstorming results are returned in the conversation unless the user specifically asks for documentation to be written and committed.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill is predominantly written in Chinese and presents imperative workflow instructions without any user opt-in about language. In practice, this can steer the agent into operating in a language the user did not request, reducing transparency and making approvals, design review, and safety-relevant decisions harder for some users to understand.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use this skill 'before any creative work' and then enumerates broad categories like creating features, building components, adding functionality, or modifying behavior. That scope is so expansive that it can hijack normal workflows and force this skill into many situations where it may be unnecessary, increasing the chance of process abuse or denial-of-work through mandatory gating.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger and hard-gate language requires this process before 'any implementation action' and says every project must follow it regardless of complexity. This ambiguity and absolutism can override user intent, create unnecessary blocking, and cause the agent to stall or refuse legitimate low-risk tasks until an unrelated approval flow is completed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.