ClawHub
Back to skill

Security audit

using-superpowers

Security checks for vulnerabilities and agentic risk

Overview

This skill is transparent about its purpose, but it is a broad agent-behavior wrapper that tries to run before nearly every interaction and force other skill use.

Install only if you explicitly want a global workflow-enforcement skill that can shape almost every agent response by pushing skill checks first. It does not appear to contain code, exfiltration, or destructive behavior, but its scope is broad enough that users should review whether they want this much control over normal agent behavior.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Vague Triggers

High
Confidence
98% confidence
Finding
The skill description says it should be used when starting any conversation, which creates an effectively universal trigger condition. That broad scope can let this skill preempt normal instruction handling and force unnecessary skill invocation across unrelated tasks, increasing the chance of instruction hijacking or denial of service against the agent's normal workflow.

Vague Triggers

High
Confidence
98% confidence
Finding
The instruction to invoke a skill whenever there is even a 1% chance it might apply is intentionally vague and expansive, making the activation threshold subjective and effectively always true. This enables the skill to self-amplify and dominate agent behavior, potentially overriding task-appropriate reasoning and causing recursive or unnecessary skill loading before any real work begins.

Agent Config Directory Access

High
Category
Agent Snooping
Content
## Subagent dispatch requires multi-agent support

Add to your Codex config (`~/.codex/config.toml`):

```toml
[features]
Confidence
90% confidence
Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Vague Triggers

Medium
Confidence
94% confidence
Finding
Requiring skill invocation before any response, including clarifying questions or initial exploration, removes important safety and scoping steps that an agent may need to act correctly. In context, this makes the skill more dangerous because it is a process-level wrapper intended to run first, so it can intercept nearly every interaction and steer subsequent behavior before the user intent is fully understood.

Skill Enumeration

Medium
Category
Agent Snooping
Content
## Personal skills directory

User-level skills live at **`~/.gemini/skills/`**, with **`~/.agents/skills/`** as a cross-runtime alias (shared with Codex and Copilot CLI). When both directories exist at the same scope, `.agents/skills/` takes precedence. Each skill is a subdirectory containing a `SKILL.md` (with `name` and `description` frontmatter).

## Subagent support
Confidence
85% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Static analysis

No suspicious patterns detected.