SuperClaw

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:53 AM UTC
• Version: 1.0.0

Overview

This workflow-skill bundle is mostly coherent, but it needs Review because it can create persistent repository changes and includes an optional unauthenticated browser companion that can be exposed beyond localhost.

Install only if you trust this publisher and want an assertive workflow system that may write files, commit changes, spawn subagents, and create or edit skills. Pin the installer version, keep the visual companion on localhost or behind an authenticated tunnel, do not publish `.superpowers/brainstorm` contents accidentally, and review any git commits or skill edits before accepting them.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29

Finding

Mutable Package Version Executed Through npx

Content

View full analysis

Remediation

View remediation

install superclaw ``` 2. Prefer a lockfile-backed installation process that records package integrity hashes. 3. Publish signed releases or checksums and document how users should verify them. 4. Review package lifecycle scripts and transitive dependencies before updating the pinned version. 5. Use an automated dependency-update process that subjects each version change to security review rather than silently tracking `latest`. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: brainstorming/scripts/server.cjs:158

Finding

Unauthenticated Brainstorming Server Can Be Exposed to the Network

Content

View full analysis

isFullDocument(raw) ? raw : wrapInFrame(raw))(fs.readFileSync(screenFile, 'utf-8')) : WAITING_PAGE; if (html.includes('')) { html = html.replace('', helperInjection + '\n'); } else { html += helperInjection; } res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' }); res.end(html); } else if (req.method === 'GET' && req.url.startsWith('/files/')) { const fileName = req.url.slice(7); const filePath = path.join(SCREEN_DIR, path.basename(fileName)); if (!fs.existsSync(filePath)) { res.writeHead(404); res.end('Not found'); return; } const ext = path.extname(filePath).toLowerCase(); const contentType = MIME_TYPES[ext] || 'application/octet-stream'; res.writeHead(200, { 'Content-Type': contentType }); res.end(fs.readFileSync(filePath)); } else { res.writeHead(404); res.end('Not found'); } } ``` ...[truncated 4721 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: brainstorming/scripts/stop-server.sh:7

Finding

Caller-Controlled Cleanup Path Can Terminate Unrelated Processes and Delete Arbitrary Temporary Directories

Content

View full analysis

"}' exit 1 fi PID_FILE="${SCREEN_DIR}/.server.pid" if [[ -f "$PID_FILE" ]]; then pid=$(cat "$PID_FILE") # Try to stop gracefully, fallback to force if still alive kill "$pid" 2>/dev/null || true # Wait for graceful shutdown (up to ~2s) for i in {1..20}; do if ! kill -0 "$pid" 2>/dev/null; then break fi sleep 0.1 done # If still running, escalate to SIGKILL if kill -0 "$pid" 2>/dev/null; then kill -9 "$pid" 2>/dev/null || true # Give SIGKILL a moment to take effect sleep 0.1 fi if kill -0 "$pid" 2>/dev/null; then echo '{"status": "failed", "error": "process still running"}' exit 1 fi rm -f "$PID_FILE" "${SCREEN_DIR}/.server.log" # Only delete ephemeral /tmp directories if [[ "$SCREEN_DIR" == /tmp/* ]]; then rm -rf "$SCREEN_DIR" fi echo '{"status": "stopped"}' else echo '{"status": "not_running"}' fi ``` ### Technical Analysis The script accepts an arbitrary directory from its caller and trusts the `.server.pid` file found in that directory. It does not: - Canonicalize the supplied path. - Require the expected `/tmp/brainstorm-` naming convention. - Verify a session marker or random nonce. - Validate that the PID consists only of a safe numeric value. - Verify that the process belongs to the current user. - Verify that the target process is the expected `server.cjs` instance. - Account for PID reuse after the original server exits. - Confirm ownership of the directory before recursively deleting it. The only deletion boundary is a lexical check for the `/tmp/*` prefix. Therefore, any caller-selected temporary directory containing `.server.pid` can b ...[truncated 1599 chars]

Remediation

View remediation

-`. 3. Create a cryptographically random session marker at startup and require it during cleanup. 4. Reject symbolic-link session directories and verify directory ownership and permissions. 5. Validate the PID before use: ```bash [[ "$pid" =~ ^[1-9][0-9]*$ ]] || exit 1 ``` 6. Verify the process owner and inspect the process executable or command line to confirm that it is the expected `server.cjs` instance associated with the same session. 7. Prefer a private control channel or retain a live process handle instead of relying solely on a reusable PID. 8. Refuse recursive deletion unless all path, owner, marker, and session checks succeed. 9. Delete only known generated files where practical rather than recursively deleting an arbitrary caller-supplied directory. 10. Use a restrictive `umask` and create session directories with permissions that prevent modification by other users. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (61)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a collection of agent workflow skills for coding and task execution. The supplied code chunk is not an agent workflow skill implementation for TDD/debugging/code review/etc.; it is a front-end browser helper specifically for a brainstorming interface. Its primary behavior is UI interaction tracking and real-time communication with a server via WebSocket, including remote-triggered page reloads and DOM updates. While 'brainstorming' is mentioned in the description, this code introduces concrete browser/network capabilities that are not reflected in the declared purpose and are materially different from a generic workflow-skill description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description presents a comprehensive collection of 14 agent workflow skills spanning many disciplines. The supplied code chunk, however, only implements three condition-based waiting helpers over thread events for debugging/test reliability. This is not merely a partial implementation detail of the described suite; the chunk’s observable purpose is much narrower and materially different from the declared broad capability set. There is no evidence here of TDD orchestration, code review, planning, brainstorming, verification, or subagent dispatch. No suspicious extra permissions or hidden resource access are shown, but the primary purpose is mismatched due to substantial overclaiming in the description relative to the actual code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a collection of agent workflow skills for software engineering tasks such as TDD, debugging, review, planning, and verification. The supplied code instead implements a documentation/visualization helper: it parses markdown for Graphviz blocks and renders them to SVG files. This is a materially different primary purpose and includes concrete capabilities—filesystem operations and external command execution—that are not suggested by the description. While the code may support understanding skill documentation, it does not itself implement the described agent workflow behaviors.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This section defines the trigger scope as 'ANY technical issue,' which is an unbounded activation condition rather than a precise invocation rule. Because it lacks negative examples or constraints, it risks unintended invocation for broad everyday engineering tasks beyond systematic debugging.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The example diagnostic sequence includes enumerating environment state and signing identities via keychain inspection commands. While intended for troubleshooting, this can reveal sensitive credential metadata and security configuration details that may aid lateral movement or credential targeting if exposed in shared logs.

Content

Scanner excerpt · systematic-debugging/SKILL.md (reported line 100)May include surrounding context.

md

env | grep IDENTITY || echo "IDENTITY not in environment"

   # Layer 3: Signing script
   echo "=== Keychain state: ==="
   security list-keychains
   security find-identity -v

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The explicit security find-identity -v example enumerates available signing identities from the keychain, exposing credential-related metadata. Although it does not directly extract private keys, revealing available identities and security tooling state can still leak sensitive operational details in agent-visible output or CI artifacts.

Content

Scanner excerpt · systematic-debugging/SKILL.md (reported line 101)May include surrounding context.

md

# Layer 3: Signing script
   echo "=== Keychain state: ==="
   security list-keychains
   security find-identity -v

   # Layer 4: Actual signing

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The example recommends collecting and logging sensitive execution context, including full filesystem paths, current working directory, and a stack trace, for 'forensics'. In an agent or production environment, these logs can expose internal directory layouts, source locations, secrets embedded in paths or arguments, and other operational details that may be accessible to users, downstream tooling, or centralized log systems.

Content

Scanner excerpt · systematic-debugging/defense-in-depth.md (reported line 73)May include surrounding context.

text

### Layer 4: Debug Instrumentation
**Purpose:** Capture context for forensics

```typescript
async function gitInit(directory: string) {

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is explicitly designed to be used when starting any conversation, which makes its trigger scope effectively universal rather than narrowly scoped to a specific task domain. In an agent system, this broad activation can force unnecessary workflow interception, increase instruction contention, and make it easier for this skill to dominate behavior before more appropriate safeguards or task-specific skills are considered.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The 'even a 1% chance a skill might apply, you MUST invoke that skill' rule creates an extremely low and ambiguous activation threshold that can be satisfied in almost any interaction. This encourages recursive or excessive skill loading, delays normal responses, and can be abused to hijack agent behavior into mandatory skill invocation loops or unnecessary privilege expansion through additional workflow instructions.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · using-superpowers/references/codex-tools.md (reported line 18)May include surrounding context.

Subagent dispatch requires multi-agent support

Add to your Codex config (~/.codex/config.toml):

toml

[features]

Self-Modification

High

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill explicitly instructs the agent to create or modify skills, which is a form of self-modification of the agent's behavioral documentation. In a trusted local development workflow this may be intended, but from a security perspective it enables persistence and policy shaping if invoked inappropriately or by untrusted prompts.

Content

Scanner excerpt · writing-skills/SKILL.md (reported line 41)May include surrounding context.

md

| **Refactor** | Close loopholes while maintaining compliance |
| **Write test first** | Run baseline scenario BEFORE writing skill |
| **Watch it fail** | Document exact rationalizations agent uses |
| **Minimal code** | Write skill addressing those specific violations |
| **Watch it pass** | Verify agent now complies |
| **Refactor cycle** | Find new rationalizations → plug → re-verify |

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

This section normalizes writing new skills as part of the workflow, reinforcing the ability to change the agent's future behavior and reference corpus. Even though the content emphasizes testing discipline, the capability itself can be abused to introduce persistent unsafe instructions or backdoored guidance.

Content

Scanner excerpt · writing-skills/SKILL.md (reported line 382)May include surrounding context.

md

This applies to NEW skills AND EDITS to existing skills.

Write skill before testing? Delete it. Start over.
Edit skill without testing? Same violation.

**No exceptions:**

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Encouraging edits to existing skills increases risk because an attacker or compromised workflow could subtly alter trusted documentation that future agents rely on. This creates a persistence vector that is more dangerous than ephemeral output because it can influence later sessions and tasks.

Content

Scanner excerpt · writing-skills/SKILL.md (reported line 383)May include surrounding context.

md

This applies to NEW skills AND EDITS to existing skills.

Write skill before testing? Delete it. Start over.
Edit skill without testing? Same violation.

**No exceptions:**
- Not for "simple additions"

Self-Modification

High

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The instruction to write a minimal skill again grants content-authoring power over the skill corpus, which can be leveraged to encode unsafe procedures or manipulative prompts. The TDD framing lowers accidental quality issues, but it does not mitigate the underlying persistence risk of self-modification.

Content

Scanner excerpt · writing-skills/SKILL.md (reported line 548)May include surrounding context.

md

### GREEN: Write Minimal Skill

Write skill that addresses those specific rationalizations. Don't add extra content for hypothetical cases.

Run same scenarios WITH skill. Agent should now comply.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The concluding guidance broadly reinforces creation of new skills as a standard action, increasing the chance that an agent treats self-modification as routine. In context this is not overtly malicious, but it expands the attack surface by making persistent instruction changes part of normal operation.

Content

Scanner excerpt · writing-skills/SKILL.md (reported line 652)May include surrounding context.

md

**Creating skills IS TDD for process documentation.**

Same Iron Law: No skill without failing test first.
Same cycle: RED (baseline) → GREEN (write skill) → REFACTOR (close loopholes).
Same benefits: Better quality, fewer surprises, bulletproof results.

If you follow TDD for code, follow it for skills. It's the same discipline applied to documentation.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · writing-skills/anthropic-best-practices.md (reported line 5)May include surrounding context.

md

> Learn how to write effective Skills that Claude can discover and use successfully.

Good Skills are concise, well-structured, and tested with real usage. This guide provides practical authoring decisions to help you write Skills that Claude can discover and use effectively.

For conceptual background on how Skills work, see the [Skills overview](/en/docs/agents-and-tools/agent-skills/overview).

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · writing-skills/testing-skills-with-subagents.md (reported line 9)May include surrounding context.

md

**Testing skills is just TDD applied to process documentation.**

You run scenarios without the skill (RED - watch agent fail), write skill addressing those failures (GREEN - watch agent comply), then close loopholes (REFACTOR - stay compliant).

**Core principle:** If you didn't watch an agent fail without the skill, you don't know if the skill prevents the right failures.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · writing-skills/testing-skills-with-subagents.md (reported line 36)May include surrounding context.

md

|-----------|---------------|-------------|
| **RED** | Baseline test | Run scenario WITHOUT skill, watch agent fail |
| **Verify RED** | Capture rationalizations | Document exact failures verbatim |
| **GREEN** | Write skill | Address specific baseline failures |
| **Verify GREEN** | Pressure test | Run scenario WITH skill, verify compliance |
| **REFACTOR** | Plug holes | Find new rationalizations, add counters |
| **Stay GREEN** | Re-verify | Test again, ensure still compliant |

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · writing-skills/testing-skills-with-subagents.md (reported line 84)May include surrounding context.

md

|-----------|---------------|-------------|
| **RED** | Baseline test | Run scenario WITHOUT skill, watch agent fail |
| **Verify RED** | Capture rationalizations | Document exact failures verbatim |
| **GREEN** | Write skill | Address specific baseline failures |
| **Verify GREEN** | Pressure test | Run scenario WITH skill, verify compliance |
| **REFACTOR** | Plug holes | Find new rationalizations, add counters |
| **Stay GREEN** | Re-verify | Test again, ensure still compliant |

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · writing-skills/testing-skills-with-subagents.md (reported line 364)May include surrounding context.

md

|-----------|---------------|-------------|
| **RED** | Baseline test | Run scenario WITHOUT skill, watch agent fail |
| **Verify RED** | Capture rationalizations | Document exact failures verbatim |
| **GREEN** | Write skill | Address specific baseline failures |
| **Verify GREEN** | Pressure test | Run scenario WITH skill, verify compliance |
| **REFACTOR** | Plug holes | Find new rationalizations, add counters |
| **Stay GREEN** | Re-verify | Test again, ensure still compliant |

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The install command uses npx clawhub@latest, which fetches and executes the latest published package version at install time. This creates a supply-chain risk because a compromised or malicious new release could be executed automatically by users without prior review or version pinning.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill declares it 'MUST' be used before any creative work or behavior modification, which is an overly broad trigger that can hijack many unrelated user requests and force an unnecessary workflow. In an agent setting, this can cause denial of intent, excessive questioning, and redirection away from the user's requested action, especially because the activation boundaries and exemptions are not clearly defined.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · brainstorming/SKILL.md (reported line 22)May include surrounding context.

md

## Checklist

You MUST create a task for each of these items and complete them in order:

1. **Explore project context** — check files, docs, recent commits
2. **Offer visual companion** (if topic will involve visual questions) — this is its own message, not combined with a clarifying question. See the Visual Companion section below.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The checklist mandates writing a design document and committing it to the repository without first requiring explicit user consent or warning about side effects. This is dangerous because it authorizes persistent filesystem and git-history modifications during what may otherwise be expected as a planning-only interaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation section repeats mandatory instructions to save the design under a fixed path and commit it to git, again without a user-warning or opt-in step. Requiring persistence by default increases the chance of unintended repo changes, noisy commits, and accidental disclosure of sensitive planning content into version control.

Content

No source excerpt is available for this finding.