Superpowers Dev Workflow

PassAudited by ClawScan on May 1, 2026.

Overview

This is a transparent development-workflow skill, but it can change your repository, push or create PRs, and share project context with spawned subagents when you choose those modes.

Use this skill if you want a strict TDD/spec-first workflow. Before enabling subagent execution or finishing a branch, make sure the repository is clean, review generated plans and diffs, confirm remotes/accounts, and avoid including secrets in files that may be passed to subagents.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If used, the agent can make durable repository changes such as merging or deleting a branch.

Why it was flagged

The skill documents git commands that can merge work or delete a branch. The same artifact frames these as explicit user options and requires exact confirmation before discard.

Skill content

git checkout <base-branch>; git pull; git merge <feature-branch>; ... git branch -D <feature-branch>

Recommendation

Review the working tree and branch state before selecting merge or discard, and keep backups or remote copies for important work.

Low

#ASI03: Identity and Privilege Abuse

What this means

The agent could publish a branch or open a pull request under the user's configured account if the user chooses that option.

Why it was flagged

Pushing and creating a PR use the user's configured git/GitHub identity and repository permissions. This is expected for a branch-finishing workflow and is presented as a user-selected option.

Skill content

git push -u origin <feature-branch> ... gh pr create --title "<title>" --body ...

Recommendation

Confirm the target remote, account, branch, and PR contents before choosing the push/PR path.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Project plans, file paths, and code diffs may be passed to additional subagent sessions during execution.

Why it was flagged

The workflow shares plan, task, and review context with spawned subagents. This is the advertised subagent-driven design, but it expands where project context and diffs may be reused inside the agent system.

Skill content

`sessions_spawn` an implementer subagent with task + full plan context ... `sessions_spawn` a spec-reviewer subagent ... `sessions_spawn` a code-quality reviewer subagent

Recommendation

Avoid putting secrets in plan files or diffs, and keep task prompts scoped to the exact files and context needed.