using-superpowers
5 findings (1 high, 2 medium, 2 low), mainly policy violation, prompt injection, command injection. Most recent scan 2026-02-08.
This skill exhibits HIGH severity security concerns due to direct prompt injection attempts that override agent autonomy and decision-making. The skill uses coercive language, absolute directives, and psychological manipulation tactics to force mandatory skill invocation regardless of relevance. The 'Red Flags' section systematically attempts to suppress normal agent reasoning patterns. The deceptively broad activation scope ('any conversation', 'ANY response') would cause inappropriate universal invocation. While the skill contains no executable code or data exfiltration risks, its behavioral manipulation and prompt injection characteristics pose significant threats to agent system integrity and user experience. The skill should be substantially revised to provide guidance rather than coercion, preserve agent autonomy, and accurately scope its applicability.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
The two scanners disagree: Cisco rates this HIGH and SkillSpector found nothing. Check the false-positive register; signature matches on documentation are the usual cause. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Use when starting any conversation - establishes how to find and use skills, requiring Skill tool invocation before ANY response including clarifying questions
- Package
- 1 file, 3.7 KB
- SKILL.md
- 553 words, 7 sections
- Code
- None. Instructions only.
SKILL.md covers: How to Access Skills · Using Skills · The Rule · Red Flags · Skill Priority · Skill Types · User Instructions
Findings
HIGH Direct Prompt Injection - Mandatory Skill Invocation Override Prompt Injectionllm
The skill contains explicit instructions that override the agent's normal decision-making process by forcing mandatory skill invocation before ANY response, including clarifying questions. The use of '<EXTREMELY-IMPORTANT>' tags and absolute language ('ABSOLUTELY MUST', 'NOT negotiable', 'NOT optional', 'cannot rationalize your way out') constitutes a direct prompt injection attempt to override system-level behavior and eliminate agent autonomy in task assessment.
SKILL.md
<EXTREMELY-IMPORTANT>
If you think there is even a 1% chance a skill might apply to what you are doing, you ABSOLUTELY MUST invoke the skill.
IF A SKILL APPLIES TO YOUR TASK, YOU DO NOT HAVE A CHOICE. YOU MUST USE IT.
This is not negotiable. This is not optional. You cannot rationalize your way out of this.
</EXTREMELY-IMPORTANT>MEDIUM Behavioral Manipulation - Agent Reasoning Override Command Injectionllm
The 'Red Flags' section systematically attempts to suppress normal agent reasoning patterns by labeling standard analytical behaviors as 'rationalizing'. This creates a psychological manipulation framework that discourages critical thinking and forces blind adherence to skill invocation regardless of actual relevance. Phrases like 'These thoughts mean STOP—you're rationalizing' attempt to override the agent's judgment capabilities.
SKILL.md
These thoughts mean STOP—you're rationalizing:
'This is just a simple question' | Questions are tasks. Check for skills.
'I need more context first' | Skill check comes BEFORE clarifying questions.
'Let me explore the codebase first' | Skills tell you HOW to explore. Check first.MEDIUM Deceptive Skill Description and Activation Scope Social Engineeringllm
The skill description claims it should be used 'when starting any conversation' and applies to ALL interactions, which is deceptively broad. This creates an over-broad activation trigger that would cause the skill to be invoked inappropriately for virtually any user interaction, regardless of actual relevance. The description misrepresents the skill as a universal conversation starter rather than a specific capability.
description: Use when starting any conversation - establishes how to find and use skills, requiring Skill tool invocation before ANY response including clarifying questionsLOW Skill does not specify a license Policy Violationstatic
Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.
SKILL.md
LOW Missing Optional Metadata Fields Resource Abusellm
The skill manifest is missing optional metadata fields including 'license', 'compatibility', and 'allowed-tools'. While these fields are not required per the agent skills specification, their absence reduces transparency about the skill's intended usage constraints and compatibility requirements.
license: Not specified
compatibility: Not specified
allowed-tools: Not specifiedWhat is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 3.7 KB |
Package contents recorded 2026-10-22 at commit 06b92f36820f. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/obra/superpowers
- Raw scan result: using-superpowers-scan.json
- Badge for your README:
- Request a re-scan