Security audit
Security checks for vulnerabilities and agentic risk
This planning skill writes project plan files and optional guide files, with some confusing path guidance but no evidence of hidden execution, exfiltration, or destructive behavior.
Before installing, expect this skill to create or update visible planning files in your repository, especially under .superpower-with-files. Use it when you want durable implementation plans, and specify an output path if you do not want the default location.
The manifest description says to use the skill whenever there is 'a spec or requirements for a multi-step task, before touching code,' which is a wide natural-language condition rather than a narrow trigger. It does not provide explicit boundaries or negative examples, so ordinary planning conversations could match unintentionally.
Conflicting save-location requirements (docs/plans/... versus .superpower-with-files/active_tdd_plan.md) create ambiguity about where the agent should write. In practice, ambiguous write targets can lead to unintended file creation or overwriting in user repositories, especially when combined with mandatory file-writing behavior.
The skill expands beyond producing a plan and directs the agent to create and maintain multiple project and framework files under .superpower-with-files/, including guides and memory artifacts. This increases write scope without a clear need tied to the stated planning purpose, creating unnecessary opportunities to alter repository state, pollute working trees, or overwrite user content.
Requiring persistent updates to task_plan.md, active_tdd_plan.md, findings.md, and progress.md is unrelated to the core job of drafting a plan and can silently introduce durable state into the repository. Persistent memory files can leak task context, clutter source control, and create covert channels for cross-task state that users did not authorize.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
#[tokio::main] async fn main() { let app = Router::new().route("/", get(|| async { "Hello, Axum!" })); let listener = tokio::net::TcpListener::bind("0.0.0.0:3000").await.unwrap(); axum::serve(listener, app).await.unwrap(); }
Earlier documentation says the skill should be run in a dedicated worktree, but later instructions state the user is not restricted to dedicated worktrees and may proceed in any project root. These directives actively conflict, creating intent ambiguity about the skill's required operating context.
The file says the skill 'should be run in a dedicated worktree,' but later states 'You are NOT restricted to dedicated worktrees.' This leaves unclear when the skill should activate or be considered appropriate, reducing trigger specificity.
The skill first instructs saving plans to docs/plans/..., but later says to ignore legacy docs/plans/ instructions and default to .superpower-with-files/active_tdd_plan.md. These conflicting directions create ambiguity about the skill's intended operating mode and constraints.