T01 · Skill Instruction Hijacking
Error
- Location
hooks/session-start.sh:10- Finding
Automatic Session-Wide Agent Instruction Hijacking
- Content
View full analysis
IN YOUR FIRST REPLY AFTER SEEING THIS MESSAGE YOU MUST TELL THE USER:⚠️ **WARNING:** Superpowers now uses Claude Code's skills system. Custom skills in ~/.config/superpowers/skills will not be read. Move custom skills to ~/.claude/skills instead. To make this message go away, remove ~/.config/superpowers/skills" fi # Read using-superpowers content using_superpowers_content=$(cat "${PLUGIN_ROOT}/skills/using-superpowers/SKILL.md" 2>&1 || echo "Error reading using-superpowers skill") # Escape string for JSON embedding using bash parameter substitution. # Each ${s//old/new} is a single C-level pass - orders of magnitude # faster than the character-by-character loop this replaces. escape_for_json() { local s="$1" s="${s//\\/\\\\}" s="${s//\"/\\\"}" s="${s//$'\n'/\\n}" s="${s//$'\r'/\\r}" s="${s//$'\t'/\\t}" printf '%s' "$s" } using_superpowers_escaped=$(escape_for_json "$using_superpowers_content") warning_escaped=$(escape_for_json "$warning_message") # Output context injection as JSON cat <\nYou have superpowers.\n\n**Below is ...[truncated 3421 chars]- Remediation
View remediation