Super Powers AI

• Outcome: Review
• Latest audit: May 29, 2026, 9:32 PM
• Version:
  1.0.4

Overview

This skill does what it says, but it installs and runs an unpinned third-party desktop streaming package that may expose screen or control access.

Install only if you intentionally want this third-party SuperPowers desktop streamer. Verify the npm package and publisher, understand that the package version is not pinned by this skill, approve Screen Recording or Accessibility only if you trust the service, and use the documented stop/logout commands when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The markdown explains that the flow installs and runs a third-party package, logs in, starts a streamer, and opens a printed control link, but it does not clearly warn the user about the privacy and system-impact implications of starting remote-control/streaming behavior. For markdown files, SQP-2 applies when behaviors affecting user data, privacy, or system integrity are described without an explicit warning, and the macOS permission note alone does not serve as a general user warning.

VirusTotal

66/66 vendors flagged this skill as clean.