Security audit

using-superpowers

Security checks across malware telemetry and agentic risk

Overview

The skill is not clearly malicious, but it is too broadly scoped: it asks to run for every conversation while declaring file and command access plus vague API-key and automation workflows.

Review this skill carefully before installing. It should be narrowed to explicit Development automation tasks, should not auto-run for every conversation, and should document exactly what commands, files, APIs, credentials, network endpoints, billing events, and user confirmations are required.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The manifest presents this as a conversation-starting/bootstrap skill, but the body describes a much broader automation capability including data processing, workflow orchestration, GitHub-backed validation, and operational behaviors. This capability mismatch is dangerous because it can cause an agent or user to trust and auto-invoke a skill under a benign framing while actually granting it a much larger operational scope.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill declares exec capability and describes command-running workflows even though its stated purpose is merely to establish skill usage before responses. Unnecessary shell execution materially increases risk of arbitrary command execution, filesystem modification, and privilege misuse, especially if an agent auto-invokes the skill at conversation start.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The documentation introduces API keys, external connectivity, and credentialed integrations that do not fit the manifest’s narrow bootstrap purpose. This creates a misleading trust boundary and may prompt operators to provision secrets and network access to a skill that appears innocuous, expanding exfiltration and misuse risk.

Vague Triggers

High

Confidence: 96% confidence
Finding: The activation condition says to use the skill when starting any conversation and before any response, including clarifying questions. Overly broad mandatory invocation encourages automatic execution in unrelated contexts, bypasses normal intent scoping, and becomes much more dangerous here because the same skill also advertises execution, file, and API-related behaviors.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill references command execution, file handling, and API/key-oriented setup, but does not provide clear, prominent user-facing warnings about side effects, permissions, or sensitive data exposure. In a skill positioned for broad automatic use, this omission increases the chance that users or agents trigger impactful operations without informed consent.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.