Superpowers (OpenClaw)

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:38 AM UTC
• Version: 1.0.0

Overview

The skill is a mostly transparent Superpowers guide, but it tells users to install a mutable third-party agent plugin without pinning or verification.

Review the upstream Superpowers project before installing, prefer a pinned release or commit from a trusted source, avoid symlinking a mutable working directory unless you control it, and confirm your agent requires approval before running commands or changing project files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:44

Finding

Unpinned Third-Party Plugin Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44-55
Vulnerability Type: Unpinned and unverified third-party dependency installation
Risk Level: Medium

bash

### OpenCode manual installation
# Clone the repository
git clone https://github.com/obra/superpowers.git ~/.continue/plugins/superpowers

# Or use a symbolic link
ln -s /path/to/superpowers ~/.continue/plugins/

### Codex CLI
codex --install-plugin superpowers

Technical Analysis

The documented installation commands retrieve and install an executable AI-agent plugin without pinning it to a reviewed release tag or immutable commit. They also provide no checksum or signature verification procedure. The Codex installation command does not explicitly identify the expected publisher, registry, source, or version.

Consequently, the content installed by these commands can differ from the content reviewed when this Skill was published. If the upstream repository, maintainer account, plugin distribution channel, or a future release is compromised, users following the instructions could install altered plugin code, prompts, or configuration. The symbolic-link alternative can likewise expose the host agent to subsequent changes made within the linked local directory.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or the plugin distribution channel, or publishes a malicious future version.
2. The attacker adds malicious scripts, prompts, configuration, or agent instructions to the mutable plugin source.
3. A user follows the documented git clone or codex --install-plugin superpowers instruction without selecting a reviewed immutable version.
4. The host AI development tool discovers and loads the installed plugin.
5. The malicious content executes or influences the agent within the permissions granted to the host tool.

Impact Assessment

The precise impact depends on the plugin-loadin ...[truncated 509 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation instructions to a reviewed release and immutable commit hash rather than the default branch or latest package version.
2. State the authoritative repository URL, expected publisher identity, plugin registry, and exact version.
3. Publish and verify a cryptographic checksum or trusted signature before enabling the plugin.
4. Recommend cloning without activation, checking out the pinned commit, and reviewing its scripts, prompts, hooks, and configuration before loading it.
5. Configure the host tool with least privilege and require confirmation for command execution, sensitive file access, network activity, and project modifications.
6. For the symbolic-link method, warn that changes to the linked directory immediately affect the loaded plugin and recommend linking only to a read-only, reviewed checkout.
7. Document a secure update process in which each new revision is reviewed and its integrity information is updated explicitly.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

All user-facing natural-language content in the file is presented in Chinese, and the document does not indicate that this language choice is optional or limited to a region-specific deployment. That can violate a language/locale policy when users are not given an explicit opt-in or alternative.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases are broad, generic workflow terms such as '代码审查', '重构建议', and 'AI 编程工作流', which can cause the skill to activate in many normal conversations without explicit user intent to invoke this specific skill. In an agent setting, unintended activation can inject hidden workflow instructions or alter behavior unexpectedly, increasing the risk of prompt-context interference and unsafe autonomous actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.