Supernal Interface
PassAudited by ClawScan on May 1, 2026.
Overview
This documentation-only skill coherently teaches an AI-controllable app framework, but users should verify the npm package and carefully limit which app functions and persisted state are exposed to AI.
Before installing, verify the @supernal/interface package and source, pin a trusted version if possible, and only expose app functions and stored state that are safe for an AI assistant to access. Add confirmation steps for any tool that can delete, publish, spend money, change accounts, or modify important data.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
An AI assistant connected through this framework may be able to call registered app functions or access registered app context.
The skill instructs developers to expose application functions and readable context to AI adapters. This is central to the framework purpose, but the impact depends on what functions and data the user registers.
Decorate functions AI can call them with full type safety... autoRegisterTools: true, autoRegisterReadables: true
Register only narrowly scoped, least-privilege tools; require explicit user confirmation before destructive, financial, public-posting, or account-changing actions.
Installing the wrong or compromised package could affect the project where the framework is added.
The documentation asks users to install an external npm package without a pinned version. This is a normal setup step for a framework, but users should verify package provenance, especially because the provided registry metadata lists no homepage/source.
npm install @supernal/interface
Verify the npm package publisher and source repository, consider pinning a trusted version, and review dependency changes before installing.
Application preferences or user state may remain available across sessions and could influence future AI interactions.
The examples include state persisted across sessions using local storage. This is purpose-aligned for application state, but persisted context can later be reused or over-trusted if sensitive or attacker-controlled data is stored there.
usePersistedState('user-prefs', defaults)... new LocalStorageAdapter()... await storage.setState('user', { name: 'Alice' });Avoid storing secrets or sensitive personal data in persisted AI context, validate stored values before reuse, and provide users with a way to clear persisted state.