Superpowers Dev Workflow

• Analyzed: May 11, 2026, 4:55 AM
• Findings: 1
• Version: 1.0.0
• Hash: a7d4d6b931f52e9b36e097bf0c53916ddfa0b0051d63a6a2059ce1d7849495a4
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill bundle is suspicious due to its extensive use of powerful execution capabilities (`exec`, `sessions_spawn`) and dynamic command generation. Files like `SKILL.md`, `references/finishing-branch.md`, and `references/writing-plans.md` instruct the agent to construct and execute various shell commands (`git`, `gh`, `pytest`, `pnpm test`, `cargo test`, `go test`) using potentially user-controlled input (e.g., branch names, PR titles). This creates a significant risk of prompt injection and shell injection if user input is not rigorously sanitized, allowing an attacker to execute arbitrary commands or manipulate sub-agent behavior. While the skill's stated purpose is legitimate software development, the inherent power and lack of explicit input sanitization for command construction elevate it beyond benign.