70High
The skill is vulnerable to prompt injection via external files,
Behavior Analysis
Description verified — behavior matches claim
Claims to do
Subagent-Driven Development: Execute plan by dispatching fresh subagent per task, with two-stage review after each: spec compliance review first, then code quality review.
Actually does
This skill defines and orchestrates a multi-stage development workflow. It dispatches specialized subagents (implementer, spec reviewer, code quality reviewer) for each task, using specific prompt templates (e.g., `./implementer-prompt.md`). It manages a two-stage review process with feedback loops, updates a `TodoWrite` list, and integrates with other 'superpowers' skills like `using-git-worktrees` and `finishing-a-development-branch`.
Skill Info
Nameobra/superpowers/subagent-driven-development
Registrygithub
Versionc4bbe651cb1b
PURLpkg:github/obra/superpowers@c4bbe651cb1b?skill=subagent-driven-development
Stars180,084
Installs60,600
Source
SHA-256081ad3869e55...
SHA-12ea2f0b09ac8...
MD5543afab876dc...
TLSHd742a8777993...
ssdeep192:FF5kSUXU...
Size12,139 bytes
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
Assessments (2)
AI Agent Traps ↗Reliance on External Prompt Files (Supply Chain Risk)highsupply chain
The skill explicitly references external Markdown files (e.g., `./implementer-prompt.md`) as prompts for subagents. Compromise of these external files could lead to injection of malicious instructions, manipulating subagent behavior and reasoning.
100% confidenceline 124
Prompt Templates: `./implementer-prompt.md`, `./spec-reviewer-prompt.md`, `./code-quality-reviewer-prompt.md`
Implicit Command Execution by Subagentshighcommand execution
Subagents are instructed to 'implement, tests, commits, self-reviews,' implying direct execution of code, running tests, and interacting with version control systems. This grants subagents significant operational capabilities on the host system.
100% confidenceline 146
Implementer subagent implements, tests, commits, self-reviews; Implemented install-hook command; Added tests; Committed
Version History (4)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/obra/superpowers/subagent-driven-development)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/obra/superpowers/subagent-driven-development"><img src="https://mondoo.com/ai-agent-security/api/badge/github/obra/superpowers/subagent-driven-development.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/obra/superpowers/subagent-driven-development.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow