brainstorming

• Outcome: Review
• Latest audit: Aug 24, 2026 · 7:21 AM UTC
• Version: 1.1.1

Overview

The skill is mostly a coherent brainstorming aid, but its optional visual companion runs a persistent local web server with click logging, session tokens, browser launching, and optional non-local network exposure that users should review carefully.

Install only if you are comfortable with an optional browser companion that starts a local server, records click selections, and stores session files. Keep it bound to localhost when possible, avoid --host 0.0.0.0 on untrusted networks, add .superpowers/ to .gitignore, and stop the companion when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill instructs the agent to write spec files, commit them to git, inspect project files, and potentially start a browser companion/server, but it declares no corresponding permissions. That mismatch hides the real capability surface from users and policy enforcement, increasing the chance of unexpected file modification or shell execution under a seemingly harmless brainstorming label.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a design-discussion workflow, but the documented behavior includes server lifecycle management, browser automation, WebSocket communication, state persistence, and file generation. This hidden operational complexity materially changes the trust model: invoking a 'brainstorming' skill may launch local processes, expose local services, persist identifiers, and write data, which can be abused or surprise the user.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The helper establishes a persistent WebSocket connection, queues and sends client events, and accepts a server-issued `reload` command, but none of this behavior is disclosed by the skill description. For a brainstorming skill, hidden telemetry and server-driven navigation control exceed expected functionality and can be abused to monitor interactions or disrupt the user experience if the backend or network path is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code captures click text, choice identifiers, element IDs, and explicit choice events, then transmits them to the server without clear necessity or disclosure. In a brainstorming context, this can expose sensitive design ideas, user preferences, or internal project details entered or selected during collaborative planning.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The skill metadata describes a dialog-only brainstorming/design aid, but this file starts and exposes a persistent HTTP/WebSocket server with file watching, state storage, and client handling. That is an unnecessary expansion of capability and attack surface for the declared purpose, creating opportunities for unauthorized access, local data exposure, and unintended interaction paths even though the server includes some authentication controls.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code can launch a browser and also execute an operator-supplied command via child_process.exec using BRAINSTORM_OPEN_CMD. For a brainstorming skill, spawning local processes is outside expected scope and can lead to unintended command execution or abuse if environment configuration is influenced by another component or user session.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The guide explicitly instructs users to bind the server to 0.0.0.0, which exposes the service on non-loopback interfaces and increases the attack surface to other hosts on the local network or reachable interfaces. Although the URL key provides some access control, exposing the service still raises the risk of unauthorized probing, token leakage, misconfiguration, or unintended access in remote/containerized environments.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The helper connects over plain `ws://` and sends queued interaction events without any user-facing disclosure in the code path. Lack of transparency combined with insecure transport can expose user interaction data to interception or unexpected collection, especially on untrusted networks.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The server appends user interaction events to disk in STATE_DIR without any visible notice or consent at the point of collection. Even if the data is limited, silent persistence of interaction history can expose sensitive choices or workflow data to other local processes, backups, or later readers of the session directory.

Session Persistence

Medium

• Category: Rogue Agent

Content

fi

# Start server, capturing output to log file
# Use nohup to survive shell exit; disown to remove from job table
nohup env BRAINSTORM_DIR="$SESSION_DIR" BRAINSTORM_HOST="$BIND_HOST" BRAINSTORM_URL_HOST="$URL_HOST" BRAINSTORM_OWNER_PID="$OWNER_PID" node server.cjs "--brainstorm-server-id=$SERVER_ID" > "$LOG_FILE" 2>&1 &
SERVER_PID=$!
disown "$SERVER_PID" 2>/dev/null

• Confidence: 90% confidence
• Finding: nohup

Session Persistence

Medium

• Category: Rogue Agent

Content

fi

# Start server, capturing output to log file
# Use nohup to survive shell exit; disown to remove from job table
nohup env BRAINSTORM_DIR="$SESSION_DIR" BRAINSTORM_HOST="$BIND_HOST" BRAINSTORM_URL_HOST="$URL_HOST" BRAINSTORM_OWNER_PID="$OWNER_PID" node server.cjs "--brainstorm-server-id=$SERVER_ID" > "$LOG_FILE" 2>&1 &
SERVER_PID=$!
disown "$SERVER_PID" 2>/dev/null

• Confidence: 90% confidence
• Finding: disown

Session Persistence

Medium

• Category: Rogue Agent

Content

# Start server, capturing output to log file
# Use nohup to survive shell exit; disown to remove from job table
nohup env BRAINSTORM_DIR="$SESSION_DIR" BRAINSTORM_HOST="$BIND_HOST" BRAINSTORM_URL_HOST="$URL_HOST" BRAINSTORM_OWNER_PID="$OWNER_PID" node server.cjs "--brainstorm-server-id=$SERVER_ID" > "$LOG_FILE" 2>&1 &
SERVER_PID=$!
disown "$SERVER_PID" 2>/dev/null
echo "$SERVER_PID" > "$PID_FILE"

• Confidence: 89% confidence
• Finding: nohup

Session Persistence

Medium

• Category: Rogue Agent

Content

# Use nohup to survive shell exit; disown to remove from job table
nohup env BRAINSTORM_DIR="$SESSION_DIR" BRAINSTORM_HOST="$BIND_HOST" BRAINSTORM_URL_HOST="$URL_HOST" BRAINSTORM_OWNER_PID="$OWNER_PID" node server.cjs "--brainstorm-server-id=$SERVER_ID" > "$LOG_FILE" 2>&1 &
SERVER_PID=$!
disown "$SERVER_PID" 2>/dev/null
echo "$SERVER_PID" > "$PID_FILE"

# Wait for server-started message (check log file)

• Confidence: 89% confidence
• Finding: disown

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/server.cjs:540