registry / superpowers-controller / 0.1.4

superpowers-controller@0.1.4

Unofficial stateful workflow controller for the Superpowers methodology on OpenCode.

AI Security Review

scanned 16h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs superpowers-controller install or scripts/install.sh.

Impact

Changes the user's OpenCode control surface to load this package and select its agent by default.

Mechanism

Explicit OpenCode agent/plugin configuration mutation.

Rationale

No concrete malicious chain was found. Warn because explicit installation mutates global OpenCode agent configuration and defaults.

Evidence

package.jsondist/cli/index.jsdist/index.jsscripts/install.sh~/.config/opencode/opencode.jsonc~/.config/opencode/opencode.json~/.config/opencode/tui.jsonc~/.config/opencode/tui.json~/.config/opencode/superpowers-controller.jsonc~/.config/opencode/skills

Decision evidence

public snapshot

AI called this at 90.0% confidence with false-positive risk.

superpowers-controller@0.1.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code