It dispatches subagents using an unknown external template
Claims to do
Requesting Code Review: Dispatch superpowers:code-reviewer subagent to catch issues before they cascade. The reviewer gets precisely crafted context for evaluation — never your session's history. This keeps the reviewer focused on the work product, not your thought process, and preserves your own context for continued work.
Actually does
This skill uses `git` commands (`git rev-parse`, `git log`) to identify specific commit SHAs. It then instructs the user to dispatch a `superpowers:code-reviewer` subagent via a `Task` tool, providing it with a structured context including implemented features, requirements, and the identified SHAs, likely using a template file like `code-reviewer.md`.
The skill dispatches a subagent using an external template (`code-reviewer.md`) and user-provided inputs. The content of this template is unknown, posing a supply chain risk. If the template is malicious or vulnerable to prompt injection from user inputs, it could lead to arbitrary actions by the subagent.
Use Task tool with superpowers:code-reviewer type, fill template at `code-reviewer.md`
Placeholders: {WHAT_WAS_IMPLEMENTED} ... {DESCRIPTION}The skill provides `git` commands for obtaining SHAs. If the AI is configured to execute these commands and any part of the command string is derived from unsanitized user input, it could lead to command injection.
BASE_SHA=$(git rev-parse HEAD~1)
[](https://mondoo.com/ai-agent-security/skills/github/obra/superpowers/requesting-code-review)<a href="https://mondoo.com/ai-agent-security/skills/github/obra/superpowers/requesting-code-review"><img src="https://mondoo.com/ai-agent-security/api/badge/github/obra/superpowers/requesting-code-review.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/obra/superpowers/requesting-code-review.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.