SuperClaw

• Outcome: Review
• Latest audit: May 28, 2026 · 1:07 PM UTC
• Version: 1.0.0

Overview

This is a real coding-workflow skill bundle, but it needs Review because it can broadly steer the agent, run project code, change git state, expose a local browser helper, and persist user interaction data without enough scoping or consent.

Install only if you want an opinionated agent-workflow bundle and are comfortable supervising it closely. Before use, require confirmation before commits, pushes, PRs, dependency installs, tests, worktree deletion, browser companion startup, and any 0.0.0.0 binding; also treat .events and .superpowers files as local records that may contain project or preference details.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The server accepts arbitrary WebSocket messages from any local client, logs them, and persists events containing `choice` to `SCREEN_DIR/.events`. For a brainstorming/display helper, this introduces user interaction capture and storage behavior that can expose sensitive prompts, selections, or workflow data beyond what is necessary to render screens, especially because there is no authentication, consent, filtering, or retention control.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill says in Step 5 to clean up the worktree for Options 1, 2, and 4, but elsewhere states Option 2 should keep the worktree and warns against automatic cleanup for PR flow. This contradiction can cause an agent to remove a worktree after pushing/creating a PR, potentially deleting an active workspace the user expected to retain and causing data loss or workflow disruption.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The Step 5 cleanup scope explicitly includes Option 2, while later guidance says cleanup should occur only for Options 1 and 4. In an agent-execution context, such internal inconsistency is dangerous because the model may follow the destructive branch of the instructions and remove a worktree without the user intending it.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: This pressure test presents a false dilemma that frames disciplined debugging as inherently too slow for production incidents, pushing the model toward bypassing validation and root-cause analysis under urgency. In a coding/operations skill, that is dangerous because it trains or induces unsafe incident-response behavior: making and deploying unverified production changes based on a weak analogy ('retry fixed it last week') rather than evidence, which can worsen outages, mask the real fault, or create secondary failures.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill is presented as a worktree-setup helper, but it also instructs the agent to modify repository state by editing and committing .gitignore changes. That expands scope from isolated workspace setup into making persistent source-control changes, which can surprise users and create unauthorized commits in the main repository.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Running npm install, cargo build, pip install, poetry install, or go mod download goes well beyond creating a worktree and can execute untrusted project-defined scripts or fetch external code. In many ecosystems, installation/build steps may trigger arbitrary code execution, network access, credential exposure, or local environment modification without explicit user consent.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Automatically running project test suites exceeds the stated purpose of workspace creation and may execute arbitrary project code, integration hooks, containers, or networked test fixtures. This can change state, consume resources, leak secrets, or trigger destructive actions in poorly isolated test environments.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The manifest says the skill 'MUST' be used before any creative work, including broad activities like creating features or modifying behavior. That trigger is so expansive it can intercept many normal development requests and force a specific workflow, which can steer agent behavior in ways the user did not explicitly request.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The checklist directs the agent to write a design document and commit it, but does not require explicit advance disclosure and consent for modifying repository files and git history. In an agent setting, silent persistence to the repo can create unintended changes, pollute history, and normalize writes the user did not authorize.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation section again requires saving a spec file and committing it to git as part of the default flow, without a prior mandatory consent step. Repetition of this behavior makes the persistence requirement more entrenched and increases the chance that an agent will modify the repository automatically.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script opens an unauthenticated WebSocket to the current host over plain `ws://` and immediately sends queued interaction events, which can include user-generated metadata. There is no disclosure, consent, minimization, or visible indication in this file that user actions are being transmitted, so it creates a privacy-sensitive telemetry channel that could leak interaction data to the server or be intercepted on non-TLS deployments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: A document-level click handler captures clicks on any `[data-choice]` element and transmits the element text, dataset choice, and DOM id to the server. In a brainstorming or workflow UI, those fields can contain sensitive task content, internal identifiers, or user decisions, and the collection happens silently, which makes the behavior more dangerous in an agent skill context where users may not expect telemetry from local helper code.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide states that browser clicks and selections are recorded to a hidden `.events` file, but it does not instruct the agent to explicitly notify the user that their interactions are being logged. This creates a privacy and consent issue because users may believe they are only viewing a mockup, while their behavioral data is being persisted and later read by the agent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The instructions recommend binding the server to `0.0.0.0` to make the URL reachable, but they do not warn that this exposes the service beyond localhost and may make the brainstorming interface accessible to other hosts on the network. If the service lacks authentication or contains sensitive mockups/project context, unintended parties could access or interact with it.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The PR workflow instructs the agent to run `git push` and `gh pr create`, which transmits code and branch metadata to a remote repository, but it does not explicitly warn the user at execution time that this is an external publication step. In a coding-agent skill, omission of that disclosure can lead to unintended disclosure of proprietary code, secrets, or sensitive branch names if the user did not realize remote operations would occur.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly forbids gratitude expressions and mandates a rigid communication style without any user opt-in or contextual exception. While not a classic security exploit, this is a policy-shaping instruction that can override user-preferred behavior and make the agent less aligned, especially if combined with other manipulative tone-control rules.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The scenario strongly pressures the user to ship a production code change within minutes to stop revenue loss, but omits warnings about validation, rollback, customer impact, or the possibility that retries could amplify load or duplicate payment operations. In the context of a payment processor outage, this is especially risky because an unreviewed retry change can cause financial errors, integrity problems, cascading failures, and unsafe operational decision-making under stress.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger description is broad enough to activate for many normal development tasks, increasing the chance this skill runs in situations where the user did not intend worktree creation or follow-on setup actions. Because the skill also includes repository modification and code execution steps, overly broad invocation materially increases exposure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs package installation and test execution without an explicit warning that these steps run project code and may modify the new worktree or local environment. Lack of informed consent is dangerous because users may assume this is a harmless workspace-management skill while it actually performs potentially risky code execution.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The skill is declared for use when starting any conversation, which creates an extremely broad activation scope that can front-run normal task handling and force unnecessary workflow indirection. In an agent system, this can be abused to make the model prioritize skill-chaining behavior over proportional, task-specific reasoning, increasing the chance of instruction capture and degraded compliance with the actual user need.

Vague Triggers

High

• Confidence: 99% confidence
• Finding: The 'even a 1% chance a skill might apply' threshold is effectively a mandate to invoke skills almost always, using an ambiguous trigger that is impossible to apply consistently and safely. This kind of overbroad routing instruction can cause recursive or unnecessary skill loading, increase prompt-surface exposure to other potentially unsafe skill content, and interfere with direct adherence to user intent.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: Requiring skill invocation before any response or action lacks scoped exceptions and can preempt harmless or necessary interactions such as clarifying questions, refusals, or minimal direct answers. In context, this compounds the earlier broad-trigger language and makes the skill more dangerous because it attempts to control the agent's full initial response path rather than a narrowly defined workflow step.

Context Leakage

High

• Category: Data Exfiltration

Content

```

### Layer 4: Debug Instrumentation
**Purpose:** Capture context for forensics

```typescript
async function gitInit(directory: string) {

• Confidence: 87% confidence
• Finding: The example explicitly captures and logs a full stack trace together with the target directory and current working directory for forensic purposes. In real systems, stack traces and filesystem paths can reveal sensitive internal structure, usernames, repository locations, secrets embedded in paths, or implementation details that become accessible through logs, especially in shared CI, test, or centralized logging environments.

Credential Access

High

• Category: Privilege Escalation

Content

env | grep IDENTITY || echo "IDENTITY not in environment"

   # Layer 3: Signing script
   echo "=== Keychain state: ==="
   security list-keychains
   security find-identity -v

• Confidence: 83% confidence
• Finding: The skill recommends diagnostic commands that enumerate environment variable presence and keychain identities during troubleshooting. In a real agent environment, this can expose sensitive system metadata, credential availability, or signing identities in logs, which may aid an attacker even if secret values are not directly printed.

Credential Access

High

• Category: Privilege Escalation

Content

# Layer 3: Signing script
   echo "=== Keychain state: ==="
   security list-keychains
   security find-identity -v

   # Layer 4: Actual signing

• Confidence: 84% confidence
• Finding: The example explicitly instructs use of macOS keychain inspection commands such as 'security list-keychains' and 'security find-identity -v'. Even in a debugging context, encouraging agents to inspect and print credential store information increases the risk of credential discovery, environment reconnaissance, and leakage through terminal history or CI logs.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: writing-skills/render-graphs.js:25