subagent-driven-development

SAFE max severity MEDIUMSkillSpector Caution 0 registry skills.sh last scanned 2026-02-08 1 scan

Verdict safe, but 5 findings (2 medium, 3 low), mainly policy violation, prompt injection, resource abuse. Most recent scan 2026-02-08.

This skill implements a complex subagent orchestration workflow for development tasks. The primary security concerns are: (1) transitive trust abuse through unverified external prompt files that control subagent behavior, (2) potential resource exhaustion from unbounded autonomous iteration loops without user confirmation gates, (3) missing metadata that would help users understand requirements and constraints, and (4) an undocumented dependency on an external skill. The skill does not contain data exfiltration, credential theft, or command injection vulnerabilities. However, the autonomous nature of the workflow and reliance on external unverified content create moderate security risks. The skill would benefit from including all referenced files in the package, implementing iteration limits, and adding user confirmation checkpoints.
Scanner's overall assessment (LLM analyzer)

Findings5

Critical0

High0

Medium2

Low3

Analyzersstatic llm meta

Second scanner: NVIDIA SkillSpector

VerdictCaution 0

Score0 / 100

Issues0

Version2.12.0 (static)

SkillSpector found no issues but could not fully inspect the package, usually because SKILL.md refers to a file that is not present, so it fails closed to CAUTION instead of SAFE. Read it as "not fully checked", not as a finding. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Use when executing implementation plans with independent tasks in the current session

Package: 4 files, 14 KB
SKILL.md: 1196 words, 8 sections
Code: None. Instructions only.

SKILL.md covers: Subagent-Driven Development · When to Use · The Process · Prompt Templates · Example Workflow · Advantages · Red Flags · Integration

Findings

MEDIUM Transitive Trust Abuse via External Subagent Prompts Prompt Injectionllm

The skill references external prompt files (./implementer-prompt.md, ./spec-reviewer-prompt.md, ./code-quality-reviewer-prompt.md) that are not included in the skill package. These files control the behavior of dispatched subagents but their content cannot be verified. If these files contain malicious instructions or are modified by an attacker, the subagents could be manipulated to perform unauthorized actions. This creates a transitive trust vulnerability where the main agent trusts content from unverified external files.

SKILL.md

References to ./implementer-prompt.md, ./spec-reviewer-prompt.md, and ./code-quality-reviewer-prompt.md without including these files in the package or validating their content

Remediation: Include all referenced prompt files within the skill package so their content can be verified during security analysis. Alternatively, embed the prompt instructions directly in SKILL.md rather than referencing external files. If external files must be used, implement content validation and integrity checks before using them to dispatch subagents.

MEDIUM Unbounded Autonomous Iteration Without User Confirmation Resource Abusellm

The skill implements an automated loop that dispatches multiple subagents and performs iterative fix cycles without explicit user confirmation between iterations. The process includes: implementer subagent → spec reviewer → fixes → code quality reviewer → fixes, all happening autonomously. The instruction 'Faster iteration (no human-in-loop between tasks)' explicitly describes removing human oversight. This could lead to resource exhaustion through excessive subagent spawning, infinite fix loops if reviewers continuously reject implementations, or runaway automation consuming computational resources.

SKILL.md

Process flow shows automated loops: 'Implementer subagent fixes spec gaps' and 'Implementer subagent fixes quality issues' with decision diamonds that could loop indefinitely. Description states 'Faster iteration (no human-in-loop between tasks)' indicating intentional removal of user confirmation gates.

Remediation: Implement iteration limits (e.g., maximum 3 fix attempts per review stage). Add user confirmation checkpoints before starting fix cycles. Include timeout mechanisms to prevent infinite loops. Add resource monitoring to detect and halt excessive subagent spawning. Provide user override options to abort the automated process at any stage.

LOW Skill does not specify a license Policy Violationstatic

Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

SKILL.md

Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

LOW Missing Critical Metadata Fields Social Engineeringllm

The skill manifest is missing several important metadata fields that help users and systems understand the skill's requirements and constraints. Missing fields include: license (legal usage terms), compatibility (which environments/platforms are supported), and allowed-tools (which agent capabilities are required). While allowed-tools is optional per the specification, its absence makes it harder to assess whether the skill's behavior aligns with expected tool usage patterns, especially given the skill's complex subagent orchestration requirements.

SKILL.md

YAML manifest shows: license: Not specified, compatibility: Not specified, allowed-tools: Not specified

Remediation: Add complete metadata to the YAML frontmatter: specify an appropriate open-source license (e.g., MIT, Apache-2.0), document compatibility requirements (e.g., 'Requires Claude with subagent support'), and declare allowed-tools to indicate which agent capabilities are needed (likely [Read, Write, Bash] or [Read, Write, Python] for implementation tasks).

LOW Undocumented Dependency on External Skill Unauthorized Tool Usellm

The skill instructions reference 'superpowers:finishing-a-development-branch' as a final step in the process, but this external skill is not declared as a dependency in the manifest. This creates an implicit dependency that may fail if the referenced skill is not available in the user's environment. The skill cannot complete its stated workflow without this external dependency, but users are not informed of this requirement upfront.

SKILL.md

Instruction states 'Use superpowers:finishing-a-development-branch' with special formatting (style=filled fillcolor=lightgreen) suggesting it's a required external skill, but no dependencies are declared in the YAML manifest

Remediation: Add a 'dependencies' or 'requires' field to the YAML manifest listing 'superpowers:finishing-a-development-branch' as a required skill. Alternatively, document this dependency clearly in the description or add a prerequisites section to the instructions. Consider making this step optional or providing fallback instructions if the external skill is unavailable.

What is in the package

File	Kind	Size
`SKILL.md`	doc	9.7 KB
`code-quality-reviewer-prompt.md`	doc	630 B
`implementer-prompt.md`	doc	2.1 KB
`spec-reviewer-prompt.md`	doc	2.0 KB

Package contents recorded 2026-10-22 at commit 06b92f36820f. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://github.com/obra/superpowers
Raw scan result: subagent-driven-development-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/skills-sh-subagent-driven-development.svg)
Request a re-scan

Second scanner: NVIDIA SkillSpector

What this skill does

Findings

What is in the package

What we checked

What we did not check

Sources

Related skills