Super Dev Pipeline

• Analyzed: Apr 1, 2026, 3:36 PM
• Findings: 1
• Version: 2.3.0
• Hash: dd219d8eca4997b5fec697db9e74b4a770b2d783360444846315e0b463ae2b20
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle defines a comprehensive AI development pipeline but includes a high-risk tool, `super_dev_run`, which is described in `SKILL.md` as allowing the execution of arbitrary CLI commands. While the documentation in `references/commands.md` suggests this is intended for specific pipeline stages (e.g., `super-dev run frontend`), the unconstrained tool definition creates a significant Remote Code Execution (RCE) vulnerability. No clear evidence of intentional malice or data exfiltration was observed, but the broad execution capability is a major security concern.