Back to skill

Security audit

SPF Write Plan

Security checks for vulnerabilities and agentic risk

Overview

This planning skill writes project plan files and optional guide files, with some confusing path guidance but no evidence of hidden execution, exfiltration, or destructive behavior.

Before installing, expect this skill to create or update visible planning files in your repository, especially under .superpower-with-files. Use it when you want durable implementation plans, and specify an output path if you do not want the default location.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The manifest description says to use the skill whenever there is 'a spec or requirements for a multi-step task, before touching code,' which is a wide natural-language condition rather than a narrow trigger. It does not provide explicit boundaries or negative examples, so ordinary planning conversations could match unintentionally.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
Conflicting save-location requirements (`docs/plans/...` versus `.superpower-with-files/active_tdd_plan.md`) create ambiguity about where the agent should write. In practice, ambiguous write targets can lead to unintended file creation or overwriting in user repositories, especially when combined with mandatory file-writing behavior.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill expands beyond producing a plan and directs the agent to create and maintain multiple project and framework files under `.superpower-with-files/`, including guides and memory artifacts. This increases write scope without a clear need tied to the stated planning purpose, creating unnecessary opportunities to alter repository state, pollute working trees, or overwrite user content.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
Requiring persistent updates to `task_plan.md`, `active_tdd_plan.md`, `findings.md`, and `progress.md` is unrelated to the core job of drafting a plan and can silently introduce durable state into the repository. Persistent memory files can leak task context, clutter source control, and create covert channels for cross-task state that users did not authorize.

Session Persistence

Medium
Category
Rogue Agent
Content
#[tokio::main]
async fn main() {
    let app = Router::new().route("/", get(|| async { "Hello, Axum!" }));
    let listener = tokio::net::TcpListener::bind("0.0.0.0:3000").await.unwrap();
    axum::serve(listener, app).await.unwrap();
}
```
Confidence
75% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Intent-Code Divergence

Low
Confidence
95% confidence
Finding
Earlier documentation says the skill should be run in a dedicated worktree, but later instructions state the user is not restricted to dedicated worktrees and may proceed in any project root. These directives actively conflict, creating intent ambiguity about the skill's required operating context.

Vague Triggers

Low
Confidence
79% confidence
Finding
The file says the skill 'should be run in a dedicated worktree,' but later states 'You are NOT restricted to dedicated worktrees.' This leaves unclear when the skill should activate or be considered appropriate, reducing trigger specificity.

Vague Triggers

Low
Confidence
76% confidence
Finding
The skill first instructs saving plans to `docs/plans/...`, but later says to ignore legacy `docs/plans/` instructions and default to `.superpower-with-files/active_tdd_plan.md`. These conflicting directions create ambiguity about the skill's intended operating mode and constraints.

Static analysis

No suspicious patterns detected.