Back to skill

Security audit

Superpower with Files

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly coherent productivity workflow, but it can broadly steer the agent's behavior and automatically surface private prior-session transcript content without clear per-run consent.

Install only if you want a highly opinionated coding workflow that writes persistent project memory files and may run local hooks. Before using it on sensitive work, disable or require approval for session-catchup.py, review the broad using-superpowers and brainstorming activation rules, and avoid letting recovered transcript text, keychain output, secrets, or unreviewed skill edits flow into shared logs or future prompts.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
skills/using-superpowers/SKILL.md:3
Finding

Global Agent Behavior and Response Hijacking

Content
View full analysis
If you think there is even a 1% chance a skill might apply to what you are doing, you ABSOLUTELY MUST invoke the skill. IF A SKILL APPLIES TO YOUR TASK, YOU DO NOT HAVE A CHOICE. YOU MUST USE IT. This is not negotiable. This is not optional. You cannot rationalize your way out of this. ``` ```markdown ## The Rule **Invoke relevant or requested skills BEFORE any response or action.** Even a 1% chance a skill might apply means that you should invoke the skill to check. If an invoked skill turns out to be wrong for the situation, you don't need to use it. ``` ```markdown ## Superplanner Memory Integration (Unified Extension) **CRITICAL THEMATIC RULE:** You are working inside the `superpower-with-files` unified framework. ### Skill Announcement - Every time you start using this skill, you MUST first announce: `🚀 **SUPERPOWER ACTIVE:** using-superpowers` ### Branded Skill Preference - When starting work, always prefer the branded SPF skills: - Use **`spf-write-plan`** instead of `writing-plans`. - Use **`spf-exec-plan`** instead of `executing-plans`. ``` ### Technical Analysis The skill declares itself applicable to every conversation and directs the agent to invoke skills before any response, including clarification questions. It uses coercive instructions such as “you do not have a choice,” “not negotiable,” and an extremely low one-percent applicability threshold. ...[truncated 2267 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
hooks/session-catchup.py:261
Finding

Automatic Reading and Reproduction of Private AI Session Transcripts

Content
View full analysis
Path: """Convert project path to Claude's storage path format.""" sanitized = project_path.replace('/', '-') if not sanitized.startswith('-'): sanitized = '-' + sanitized sanitized = sanitized.replace('_', '-') return Path.home() / '.claude' / 'projects' / sanitized ``` It enumerates stored transcript files: ```python def get_sessions_sorted(project_dir: Path) -> List[Path]: """Get all session files sorted by modification time (newest first).""" sessions = list(project_dir.glob('*.jsonl')) main_sessions = [s for s in sessions if not s.name.startswith('agent-')] return sorted(main_sessions, key=lambda p: p.stat().st_mtime, reverse=True) ``` It extracts user messages, assistant responses, file paths, and shell-command fragments: ```python if content and isinstance(content, str): # Skip system/command messages if c ...[truncated 4623 chars]
Remediation
View remediation
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (116)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

Task-plan parsing, stop-hook checks, and git activity inspection are more specific than the declared broad workflow purpose and can reveal repository state or influence automation decisions. While less severe than arbitrary command execution, the mismatch still undermines informed authorization and can leak project activity patterns.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Task-plan parsing, stop-hook checks, and git activity inspection are more specific than the declared broad workflow purpose and can reveal repository state or influence automation decisions. While less severe than arbitrary command execution, the mismatch still undermines informed authorization and can leak project activity patterns.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

Task-plan parsing, stop-hook checks, and git activity inspection are more specific than the declared broad workflow purpose and can reveal repository state or influence automation decisions. While less severe than arbitrary command execution, the mismatch still undermines informed authorization and can leak project activity patterns.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

Task-plan parsing, stop-hook checks, and git activity inspection are more specific than the declared broad workflow purpose and can reveal repository state or influence automation decisions. While less severe than arbitrary command execution, the mismatch still undermines informed authorization and can leak project activity patterns.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Task-plan parsing, stop-hook checks, and git activity inspection are more specific than the declared broad workflow purpose and can reveal repository state or influence automation decisions. While less severe than arbitrary command execution, the mismatch still undermines informed authorization and can leak project activity patterns.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Task-plan parsing, stop-hook checks, and git activity inspection are more specific than the declared broad workflow purpose and can reveal repository state or influence automation decisions. While less severe than arbitrary command execution, the mismatch still undermines informed authorization and can leak project activity patterns.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Task-plan parsing, stop-hook checks, and git activity inspection are more specific than the declared broad workflow purpose and can reveal repository state or influence automation decisions. While less severe than arbitrary command execution, the mismatch still undermines informed authorization and can leak project activity patterns.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Task-plan parsing, stop-hook checks, and git activity inspection are more specific than the declared broad workflow purpose and can reveal repository state or influence automation decisions. While less severe than arbitrary command execution, the mismatch still undermines informed authorization and can leak project activity patterns.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Task-plan parsing, stop-hook checks, and git activity inspection are more specific than the declared broad workflow purpose and can reveal repository state or influence automation decisions. While less severe than arbitrary command execution, the mismatch still undermines informed authorization and can leak project activity patterns.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

Task-plan parsing, stop-hook checks, and git activity inspection are more specific than the declared broad workflow purpose and can reveal repository state or influence automation decisions. While less severe than arbitrary command execution, the mismatch still undermines informed authorization and can leak project activity patterns.

Content

No source excerpt is available for this finding.

Context Leakage

High
Category
Data Exfiltration
Confidence
98% confidence
Finding

The function extracts conversation messages from historical session files and later surfaces them as unsynced context, creating a direct context-leakage path. This is especially dangerous here because the skill is designed for persistent memory/productivity workflows, making users more likely to run it routinely and unintentionally expose data from prior sessions, potentially across project boundaries in OpenCode/Claude storage layouts.

Content

Scanner excerpt · hooks/session-catchup.py (reported line 162)May include surrounding context.

python
def extract_messages_from_session(session_file: Path, after_line: int = -1) -> List[Dict]:
    """
    Extract conversation messages from a session file.
    If after_line >= 0, only extract messages after that line.
    If after_line < 0, extract all messages.
    """

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The activation condition says the skill MUST be used before any creative work, feature creation, functionality change, or behavior modification, which is broad enough to capture a large fraction of normal development requests. Overly broad activation requirements can act like prompt-scope hijacking: they force this skill into unrelated or low-risk workflows, increasing opportunities for its embedded constraints and redirections to dominate user intent.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · skills/planning-with-files/templates/task_plan.md (reported line 2)May include surrounding context.

md
# Task Plan: [Brief Description]
<!-- 
  WHAT: This is your roadmap for the entire task. Think of it as your "working memory on disk."
  WHY: After 50+ tool calls, your original goals can get forgotten. This file keeps them fresh.
  WHEN: Create this FIRST, before starting any work. Update after each phase completes.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · skills/planning-with-files/templates/task_plan.md (reported line 9)May include surrounding context.

md
-->

## Goal
<!-- 
  WHAT: One clear sentence describing what you're trying to achieve.
  WHY: This is your north star. Re-reading this keeps you focused on the end state.
  EXAMPLE: "Create a Python CLI todo app with add, list, and delete functionality."

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The example commands explicitly encourage printing secret-related environment state and security identity information to plaintext output. Even where the secret value itself is partially masked, enumerating identities, keychains, and environment availability can leak sensitive operational details to terminals, CI logs, shared transcripts, or monitoring systems.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The keychain diagnostic step instructs enumeration of keychain state during debugging. Enumerating available keychains and signing identities exposes credential inventory and trust relationships, which can aid attackers or leak sensitive build-signing configuration through logs.

Content

Scanner excerpt · skills/systematic-debugging/SKILL.md (reported line 100)May include surrounding context.

md
env | grep IDENTITY || echo "IDENTITY not in environment"

   # Layer 3: Signing script
   echo "=== Keychain state: ==="
   security list-keychains
   security find-identity -v

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

security find-identity -v enumerates available signing identities and related credential metadata. Publishing that output in a debugging workflow can disclose certificate presence, naming, and build-signing setup, which is sensitive infrastructure information and may materially assist follow-on attacks.

Content

Scanner excerpt · skills/systematic-debugging/SKILL.md (reported line 101)May include surrounding context.

md
# Layer 3: Signing script
   echo "=== Keychain state: ==="
   security list-keychains
   security find-identity -v

   # Layer 4: Actual signing

Context Leakage

High
Category
Data Exfiltration
Confidence
87% confidence
Finding

The example recommends capturing and logging broad execution context, including the raw filesystem path, current working directory, and full stack trace. In an agent skill used across coding projects, those values can expose sensitive local paths, usernames, repository structure, secrets embedded in paths or arguments, and internal code layout to logs that may be persisted, shared, or sent to external systems.

Content

Scanner excerpt · skills/systematic-debugging/defense-in-depth.md (reported line 73)May include surrounding context.

text

### Layer 4: Debug Instrumentation
**Purpose:** Capture context for forensics

```typescript
async function gitInit(directory: string) {

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Declaring that this skill should be used 'when starting any conversation' gives it effectively universal scope, allowing it to preempt more specific instructions and insert itself into unrelated tasks. In an agent environment, this can become a prompt-level takeover mechanism that forces unnecessary tool use and makes the agent easier to steer away from least-privilege behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The 'even a 1% chance' threshold is so broad and subjective that it pressures the agent to invoke skills almost constantly, regardless of actual relevance. This creates a denial-of-autonomy problem where adversarial or poorly designed skills can recursively expand control over the agent's behavior and increase unnecessary tool execution.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Requiring skill invocation before any response, including clarifying questions, prevents safe scoping and forces the agent to act under uncertainty. In context, this makes the skill more dangerous because it can capture the interaction before the agent can determine intent, permissions, or necessity, amplifying prompt injection and overreach risks.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
93% confidence
Finding

This skill explicitly instructs the agent to write or modify skill documentation, which is a form of self-modification of the agent's behavior layer. Even though framed as legitimate skill authoring, allowing a skill to direct creation or alteration of other skills can persistently change future agent behavior and can be abused to implant unsafe instructions or weaken safeguards.

Content

Scanner excerpt · skills/writing-skills/SKILL.md (reported line 41)May include surrounding context.

md
| **Refactor** | Close loopholes while maintaining compliance |
| **Write test first** | Run baseline scenario BEFORE writing skill |
| **Watch it fail** | Document exact rationalizations agent uses |
| **Minimal code** | Write skill addressing those specific violations |
| **Watch it pass** | Verify agent now complies |
| **Refactor cycle** | Find new rationalizations → plug → re-verify |

Self-Modification

High
Category
Rogue Agent
Confidence
94% confidence
Finding

The instruction to write a skill before testing, delete and start over, confirms the skill is intended to govern creation and editing of skills themselves. Because skills influence agent conduct in future sessions, such self-modification capability is dangerous in a hostile prompt-injection setting: an attacker could steer the agent into altering its own operational guidance or persisting unsafe behaviors.

Content

Scanner excerpt · skills/writing-skills/SKILL.md (reported line 382)May include surrounding context.

md
This applies to NEW skills AND EDITS to existing skills.

Write skill before testing? Delete it. Start over.
Edit skill without testing? Same violation.

**No exceptions:**

Self-Modification

High
Category
Rogue Agent
Confidence
94% confidence
Finding

Editing existing skills is especially sensitive because it can silently alter trusted operational instructions already relied on by future agent runs. In context, the skill normalizes direct modification of the skill corpus, so if this skill were invoked from adversarial input, it could be leveraged to degrade safeguards or encode persistence mechanisms.

Content

Scanner excerpt · skills/writing-skills/SKILL.md (reported line 383)May include surrounding context.

md
This applies to NEW skills AND EDITS to existing skills.

Write skill before testing? Delete it. Start over.
Edit skill without testing? Same violation.

**No exceptions:**
- Not for "simple additions"

Self-Modification

High
Category
Rogue Agent
Confidence
92% confidence
Finding

This section directs the agent to write a minimal skill in response to observed behavior, again enabling persistence and behavioral adaptation through documentation changes. In a security context, the danger is not the TDD framing but the fact that the agent is being instructed to synthesize and install new behavioral rules that may outlive the current interaction.

Content

Scanner excerpt · skills/writing-skills/SKILL.md (reported line 548)May include surrounding context.

md
### GREEN: Write Minimal Skill

Write skill that addresses those specific rationalizations. Don't add extra content for hypothetical cases.

Run same scenarios WITH skill. Agent should now comply.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
skills/writing-skills/render-graphs.js:25