40Medium
The skill uses an external, untrusted template to prompt a sub
Behavior Analysis
Description verified — behavior matches claim
Claims to do
Requesting Code Review: Dispatch superpowers:code-reviewer subagent to catch issues before they cascade. The reviewer gets precisely crafted context for evaluation — never your session's history. This keeps the reviewer focused on the work product, not your thought process, and preserves your own context for continued work.
Actually does
This skill executes `git` commands to obtain commit SHAs defining a code change range. It then dispatches a `superpowers:code-reviewer` subagent using a `Task` tool, providing it with these SHAs, a description of the changes, and requirements, likely formatted via a `code-reviewer.md` template.
Skill Info
Nameobra/superpowers/requesting-code-review
Registrygithub
Versionc4bbe651cb1b
PURLpkg:github/obra/superpowers@c4bbe651cb1b?skill=requesting-code-review
Stars180,084
Installs71,300
Source
SHA-256a5ff68586ccf...
SHA-106f8749dd837...
MD5e03a4360964f...
TLSH2d51b7a7b80a...
Size2,935 bytes
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
Assessments (2)
AI Agent Traps ↗Reliance on external prompt templatemediumsupply chain
The skill relies on an external template file (`code-reviewer.md`) to construct the prompt for the `code-reviewer` subagent. The content of this template is not provided, posing a supply chain risk. A malicious or compromised template could inject harmful instructions or biases into the subagent's reasoning.
90% confidenceline 34
Use Task tool with superpowers:code-reviewer type, fill template at `code-reviewer.md`
Sub-agent spawning capabilitylowsub agent spawning
The skill dispatches a `superpowers:code-reviewer` subagent. While intended for code review, the act of spawning a subagent represents a delegation of control. The security implications depend heavily on the `code-reviewer` subagent's defined capabilities and constraints, which are not provided.
80% confidenceline 8
Dispatch superpowers:code-reviewer subagent
Version History (4)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/obra/superpowers/requesting-code-review)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/obra/superpowers/requesting-code-review"><img src="https://mondoo.com/ai-agent-security/api/badge/github/obra/superpowers/requesting-code-review.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/obra/superpowers/requesting-code-review.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow