Security audit

Super Powers AI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a mostly transparent wrapper for a desktop streaming CLI, but it downloads and runs an unpinned npm package with the user's normal local permissions.

Review this skill carefully before installing. Use it only if you trust the superpowers-ai npm package and publisher, and prefer running it from a least-privileged environment without sensitive environment variables. Check the resolved package version before granting Screen Recording or Accessibility permissions, and use the documented stop/logout commands when finished.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

Location: scripts/install_and_run.js:104
Finding: Unpinned Third-Party npm Package Is Installed and Executed Without Integrity Verification
Content: View full analysis
Remediation: View remediation
"; ``` 2. Commit a lockfile generated from a reviewed dependency tree and use a deterministic installation process such as `npm ci`. 3. Validate the downloaded package against a known-good integrity digest. Do not treat displayed publisher or maintainer strings as provenance verification. 4. Explicitly pin the trusted npm registry for this installation instead of silently accepting arbitrary registry overrides from the user's npm configuration. 5. Prevent lifecycle scripts during dependency acquisition where feasible: ```bash npm ci --ignore-scripts ``` If lifecycle scripts are required, audit them and their transitive dependencies before enabling them. 6. Separate installation from execution. Show the resolved package version and integrity value, require confirmation when they differ from approved values, and only execute a verified entry point. 7. Run the third-party CLI in a sandbox or restricted subprocess with: - A minimal environment allowlist. - Limited filesystem access. - Restricted network access. - No unnecessary screen-recording, accessibility, or credential-store access. 8. Enable npm audit or an equivalent software-composition analysis step. The current `--no-audit` option suppresses an available dependency risk signal. 9. Document a controlled update procedure requiring review of package contents, lifecycle scripts, dependency changes, and integrity metadata before changing the approved version. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill explicitly installs and executes a third-party npm package on the user's machine, but it declares no tool scope or permissions boundary in the skill metadata. That omission weakens reviewability and informed consent because the skill performs environment-affecting actions without machine-readable restriction metadata, increasing the chance of unintended execution in contexts that expect narrower capabilities.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation directs users to run a helper that installs and executes a third-party npm package using the current shell environment and npm configuration, but it does not prominently warn that this executes external code with the user's local permissions. That creates supply-chain and environment-abuse risk, especially because the package is fetched from the registry at runtime and may run install scripts or malicious updates if the published package is compromised.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/install_and_run.js:84