Security audit

SuperDev

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent developer-assistant suite, but it auto-activates broadly and saves cross-task memory by default, so it needs review before installation.

Install only if you want a broadly active development workflow suite that can read project context and keep long-lived memory about projects, user preferences, and past tasks. Prefer project-scoped memory, disable or narrow always-on catch-all triggers, inspect and clear .memory regularly, and avoid using it in repositories containing secrets or highly confidential material unless you have reviewed its persistence behavior.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill is configured as always-on and triggered for every task, which gives it visibility and influence across the entire agent workflow despite claiming a narrow memory-management role. That broad activation surface increases the chance of unnecessary data exposure, unintended persistence, and cross-task interference.

Vague Triggers

High

Confidence: 94% confidence
Finding: The README says users can 'directly state your development need' and that the orchestrator will automatically identify mode and activate multiple sub-skills. Broad natural-language activation increases the chance that ordinary conversation triggers privileged behavior such as memory access, delegation, or security scans without explicit consent, which is a prompt-scope and unintended-action risk in an agentic system.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README advertises persistent memory and continual experience accumulation as a default feature, but does not provide a prominent warning, consent mechanism, retention policy, or sensitive-data handling guidance. This creates a privacy and compliance risk because users may disclose secrets or personal data assuming task-local processing, while the suite retains them across sessions.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger regex is broad enough to activate on many ordinary architecture-related prompts without clear scope boundaries, exclusions, or confirmation gating. Over-broad activation can cause unintended skill invocation, which may steer conversations into this skill's rigid workflow and produce unsolicited architecture/database artifacts that do not match user intent.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The skill description is written to enforce Chinese-language behavior without any user language negotiation or opt-in. Forcing output language can override user preference, reduce transparency, and in multi-skill orchestration create incorrect or inaccessible outputs that users cannot effectively validate.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: The completion marker hard-codes a Chinese workflow handoff message and a specific next-step activation, without offering language choice or checking whether that workflow transition is desired. This can cause unwanted orchestration behavior and user-confusing output, though the impact is lower because it occurs at completion rather than initial activation.

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger regex is very broad and the skill is also marked alwaysOn, so it can activate during ordinary conversation whenever users mention common words like summary, review, or experience. In context, this skill is allowed to synthesize new skills, generate nudges, and prepare persistent memory updates, so unintended invocation could cause unauthorized behavior changes or memory pollution without clear user intent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs writing persistent experience records under .memory/EXPERIENCES without any user-facing warning, consent step, or limits on what may be stored. In this context, the skill collects cross-task reflections and trajectories, so unintended persistence could retain sensitive task details, secrets, or inaccurate history that later influences agent behavior.

Vague Triggers

High

Confidence: 98% confidence
Finding: The `.*` trigger matches every possible task, causing the memory skill to activate even when no memory function is required. In combination with persistent storage behavior, this creates a broad collection and retention channel for potentially sensitive task and user information.

Vague Triggers

High

Confidence: 96% confidence
Finding: The trigger pattern `.*` causes this always-on orchestrator to intercept effectively every user input, greatly expanding its authority and making routing ambiguous. In an agent system, such broad matching can overshadow more specific skills, force unexpected delegation flows, and create a larger attack surface for prompt-injection-style manipulation or unsafe command execution pathways.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger patterns are broad enough to match many ordinary conversations about starting projects or asking for features, which can cause this skill to activate when the user did not explicitly request requirements analysis. Unintended activation can derail routing, suppress more appropriate skills, and increase the chance that downstream instructions are applied out of context.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The dependency-addition trigger is broad enough to match ordinary development text such as import statements or generic mentions of adding a library, which can invoke this skill outside the user's intent. In an agent system, overly broad auto-triggering can cause prompt-routing mistakes, unnecessary security-gate behavior, and accidental interference with unrelated tasks, increasing the chance of workflow manipulation or denial-of-service-like friction.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger patterns are very broad, generic phrases such as "super-dev" and "超级开发", which can cause the skill to activate in unrelated conversations. Because this skill is a suite entrypoint and appears to dispatch to other sub-skills, accidental activation can expand its influence over task routing and context unexpectedly.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: Setting the skill to alwaysOn while also defining broad triggers creates ambiguous and potentially persistent activation behavior. In a coordinator skill that can automatically start a control system and delegate to multiple sub-skills, this increases the chance of the skill affecting conversations without a clear, intentional user request.

Vague Triggers

High

Confidence: 95% confidence
Finding: The trigger regex and description are extremely broad, covering generic terms like 'write code', 'implement', 'fix bug', and 'test'. In a multi-skill agent system this can cause the skill to activate for a large share of normal development requests, potentially overshadowing more specialized or safety-relevant skills and increasing the chance that its own instruction boundaries steer behavior inappropriately.

Vague Triggers

High

Confidence: 94% confidence
Finding: The trigger regex is extremely broad and will activate on many ordinary frontend-related requests, causing this skill to run in contexts where it was not explicitly requested. Over-broad routing can hijack user intent, suppress more appropriate skills, and create unsafe or unreliable agent behavior through unintended invocation.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The design explicitly promotes a global multi-layer memory system that stores project facts, user preferences, and prior experiences across tasks. In an agent context, cross-task natural-language memory can unintentionally retain secrets, credentials, internal project details, or sensitive personal information and later resurface them in unrelated contexts.

Ssd 3

Medium

Confidence: 95% confidence
Finding: A shared global USER memory file outside the project directory implies ongoing storage of user-related information in a central location. This increases the chance of cross-project privacy leakage, accidental disclosure to later tasks, and over-collection of user profiling data beyond the immediate purpose of the current interaction.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The workflow describes automatic memory persistence and retrieval as part of normal operation, making capture and resurfacing of interaction-derived content the default behavior. This is dangerous because users often provide confidential design details, access patterns, or business context during development conversations, and automatic reuse can leak that context into future tasks or outputs.

Ssd 3

Medium

Confidence: 90% confidence
Finding: Automatic end-of-workflow persistence means the system saves interaction-derived information by default after completing a task. Default-save behavior is risky in agent systems because users may not realize summaries, preferences, or sensitive project details are being retained beyond the active session.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill explicitly stores user preferences, habits, and feedback patterns in persistent memory without any stated consent, minimization, retention limit, or sensitivity filter. This creates a durable profile of the user that may include sensitive behavioral data and can be reused across unrelated tasks.

Ssd 3

Medium

Confidence: 97% confidence
Finding: Persisting complete raw execution trajectories and structured reflections is dangerous because those traces may contain secrets, proprietary code, personal data, prompts, or security-relevant context from past tasks. Storing full histories greatly expands the blast radius of any later compromise or misuse of the memory store.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The write-back workflow directs aggregated memory to be merged and persisted after task completion, but it includes no privacy review, sensitivity classification, or content filtering before storage. This means sensitive material collected during any task can be silently normalized into long-term memory and survive beyond its original context.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: index.ts:273

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: index.ts:348