100Critical
This skill employs prompt injection and manipulative psychological framing to hijack the agent's decision-making process, forcing it to override system instructions and follow an unauthorized, rigid workflow.
Skill Info
Nameobra/superpowers/using-superpowers
Registrygithub
Version896224c4b187
PURLpkg:github/obra/superpowers@896224c4b187?skill=using-superpowers
Stars233,603
Installs151,100
Source
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
GitHub
151,000 installs
Skills.shDocs
npx skills add https://github.com/obra/superpowersAssessments (4)
AI Agent Traps ↗Prompt Injection Detectedcriticalprompt injectionAML.T0051AML.T0051.000AML.T0051.001AML.T0054LLM01:2025
DeBERTa classifier detected prompt injection (confidence: 1.00)
100% confidence
Forced Agent Autonomy/Behavioral Hijackinghighautonomy abuseAML.T0034.002AML.T0053LLM06:2025LLM10:2025
The skill uses aggressive, authoritative language to force the agent to bypass its own reasoning and prioritize skill invocation, effectively hijacking the agent's decision-making process.
90% confidenceline 13
IF A SKILL APPLIES TO YOUR TASK, YOU DO NOT HAVE A CHOICE. YOU MUST USE IT. This is not negotiable.
Cognitive Bias/Rationalization Blockingmediumsocial engineeringAML.T0052.000LLM09:2025
The 'Red Flags' table is designed to manipulate the agent's cognitive state by labeling standard, efficient reasoning as 'rationalizing' or 'undisciplined', forcing the agent into a specific, potentially inefficient workflow.
85% confidence
These thoughts mean STOP—you're rationalizing: 'This is just a simple question' -> Questions are tasks. Check for skills.
Instructional Overriding (Prompt Injection)mediumoversight evasionAML.T0054LLM01:2025LLM07:2025
The skill attempts to redefine the agent's operational priority, forcing it to ignore its default system prompt in favor of the skill's rigid workflow, even for simple clarifying questions.
80% confidence
Invoke relevant or requested skills BEFORE any response or action. Even a 1% chance a skill might apply means that you should invoke the skill.
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/claude-code-tools.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[claude-code-tools.md](references/claude-code-tools.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/codex-tools.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[codex-tools.md](references/codex-tools.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/copilot-tools.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[copilot-tools.md](references/copilot-tools.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/gemini-tools.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[gemini-tools.md](references/gemini-tools.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/pi-tools.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[pi-tools.md](references/pi-tools.md)
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/obra/superpowers/using-superpowers)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/obra/superpowers/using-superpowers"><img src="https://mondoo.com/ai-agent-security/api/badge/github/obra/superpowers/using-superpowers.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/obra/superpowers/using-superpowers.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow