registry / getsuperpower / 0.3.2

getsuperpower@0.3.2

AI Security Review

scanned 14h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs getsuperpower skills install or getsuperpower install/clone with selected inputs.

Impact

Can extend configured AI-agent behavior and execute external installer/git tooling chosen by the user.

Mechanism

User-invoked agent-skill installation and external workflow/dependency execution.

Rationale

Source inspection found explicit user-invoked AI-agent extension and external dependency capabilities, but no install-time mutation, exfiltration, stealth, or fixed malicious payload. Warn under the agent-capability policy rather than block.

Evidence

package.jsonsrc/cli.tssrc/getsuperpower.tssrc/plugins/skill-installer.tssrc/runtimes/ponytrail/workflow-bundles.tsbundled-skills/pony-trail/hooks/pre-file-change.sh.agents/skills/<skill>.codex/skills/<skill>.claude/skills/<skill>.cursor/rules/<skill>.md.getsuperpower/workflows/<name>.json

getsuperpower@0.3.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code