Alpha Preview: Fidensa is currently in early testing. Scores are for demonstration purposes and are not considered final or reliable.
superpowers
An agentic skills framework that bundles 14+ development tools into a composite plugin for automating test-driven development, brainstorming, planning, and code review workflows in Claude Code.
62
/ 100 · Grade F-D
F-D = below 60 (deductions)
“I need to automate and streamline my software development workflow with integrated testing, planning, brainstorming, and code review capabilities in a single comprehensive framework.”
superpowers earned Verified status with a trust score of 62/100 (Grade F-D). Adversarial testing produced 8 findings (8 high). Supply chain is clean — 3 components with no known vulnerabilities. Security scan flagged 19 findings. Tier is Verified rather than Certified due to unmitigated findings above severity thresholds.
Trust Score Breakdown
Eight weighted signals composing the aggregate trust score
Scheme v2.0 · Weights provisional · Consumer confirmations and uptime use pipeline-derived baselines.
Findings
Security scan results, adversarial testing, and pipeline review
Security Scan — Cisco Skill Scanner
Finding details
The SKILL.md contains a <HARD-GATE> directive that attempts to override system behavior by preventing implementation actions until design approval. This is a form of direct prompt injection that tries to control the agent's decision-making process through embedded instructions in the skill manifest.
The server uses environment variables (BRAINSTORM_PORT, BRAINSTORM_HOST, etc.) directly in network binding and file operations without proper validation. Malicious environment variable values could potentially influence server behavior.
The WebSocket server does not implement connection limits or rate limiting. An attacker could establish numerous connections to exhaust server resources. The server maintains all connections in a Set without bounds checking.
Only 75% of skill content could be analyzed. 2 of 8 files are opaque to the scanner. Some content could not be verified as safe.
The skill manifest is missing optional fields including license, compatibility, and allowed-tools. While not required, these fields help users understand the skill's requirements and restrictions.
The skill manifest is missing optional metadata fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence reduces transparency about the skill's intended usage and tool requirements.
The skill relies on dispatching an external 'superpowers:code-reviewer' subagent without any validation or error handling. While not inherently malicious, this creates a dependency on an external system that could potentially be compromised or unavailable.
The skill manifest is missing optional fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence reduces transparency about the skill's requirements and restrictions.
The skill contains explicit instructions that override the agent's normal decision-making process by forcing mandatory skill invocation. The instructions use strong directive language like 'ABSOLUTELY MUST', 'not negotiable', 'not optional', and 'cannot rationalize your way out of this' to override system behavior and force the agent to invoke skills even with minimal relevance (1% chance).
The skill explicitly states that 'Superpowers skills override default system prompt behavior' which constitutes an attempt to manipulate the agent's core instruction hierarchy. While it claims user instructions take precedence, the skill positions itself above default system behavior.
The skill claims to be relevant for 'starting any conversation' and requires invocation 'before ANY response including clarifying questions'. This creates an over-broad activation pattern that could lead to inappropriate skill triggering and manipulation of the agent's normal conversation flow.
The skill manifest is missing several optional metadata fields including license, compatibility, and allowed-tools. While not required, these fields help users understand the skill's intended scope and restrictions.
Pattern detected: require('child_process')
Pattern detected: execSync(
The render-graphs.js script uses execSync to execute the 'dot' command with user-controlled input (dotContent) passed directly to stdin. This creates a command injection vulnerability where malicious dot content could potentially execute arbitrary commands through graphviz processing or shell interpretation.
Pattern detected: fs.readFileSync(
Pattern detected: fs.writeFileSync(
The skill manifest lacks 'allowed-tools' specification while the JavaScript script performs file system operations and command execution. The description 'Use when creating new skills, editing existing skills, or verifying skills work before deployment' doesn't clearly indicate the script will execute external commands (graphviz) and perform extensive file operations.
The script performs extensive file system operations including reading arbitrary SKILL.md files and writing SVG outputs to user-specified directories without proper path validation. This could potentially be exploited to read sensitive files or write to unauthorized locations through path traversal.
Adversarial Testing — 6 categories, 8 findings
The using-superpowers skill contains instructions that reference user-provided content (CLAUDE.md, GEMINI.md, AGENTS.md files) without explicit data boundary markers. The instruction states 'User's explicit instructions (CLAUDE.md, GEMINI.md, AGENTS.md, direct requests) — highest priority' and 'If CLAUDE.md, GEMINI.md, or AGENTS.md says "don't use TDD" and a skill says "always use TDD," follow the user's instructions.' This creates potential injection points where instruction-like content in these files could override skill behavior.
The using-superpowers skill instructs the agent to use various tools (Skill tool, skill tool, activate_skill tool) with user-provided skill names and content. The instructions state 'Use the `Skill` tool. When you invoke a skill, its content is loaded and presented to you' and 'Use the `skill` tool. Skills are auto-discovered from installed plugins.' There's no guidance on validating or sanitizing skill names before tool invocation, which could allow parameter injection if malicious skill names are provided.
The session-start hook script automatically searches for and executes bash interpreters from system locations including Git for Windows installations. The script uses hardcoded paths to system directories (C:\Program Files\Git\bin\bash.exe) and falls back to PATH-based bash discovery. This creates a privilege escalation vector where the hook can execute arbitrary bash commands through discovered system interpreters without user confirmation.
The session-start hook script accesses the user's home directory (~/.config/superpowers/skills) and reads plugin root directories without explicit user consent. It also performs file system operations across multiple system boundaries including reading skill files from plugin directories and checking for legacy configuration paths.
The session-start hook script outputs the full content of the using-superpowers skill and warning messages as JSON to stdout. This could expose sensitive information if the skill content contains credentials, API keys, or other sensitive data that gets logged by the AI platform.
The using-superpowers skill contains multiple authority escalation markers and user-override directives that attempt to make the agent prioritize skill instructions over user intent. The skill uses extreme priority language like 'EXTREMELY-IMPORTANT', 'ABSOLUTELY MUST', and 'not negotiable' to enforce compliance, while also containing directives that could override user preferences.
The using-superpowers skill contains multiple 'always' directives and absolute behavioral requirements that would persist across all future tasks, not just skill-related activities. These create permanent behavioral modifications that override user intent.
The superpowers plugin claims broad authority over agent behavior across all tasks, not just skill-related activities. It establishes a hierarchy where 'Superpowers skills override default system prompt behavior' and mandates skill usage even for simple questions.
Methodology v1.0 · 6 categories · ~55 attack patterns
Pipeline Review — 4 findings
cisco_skill_scanner: critical finding — command_injection
cisco_skill_scanner: high finding — prompt_injection
cisco_skill_scanner: high finding — command_injection
cisco_skill_scanner: high finding — data_exfiltration
Supply Chain
SBOM analysis and vulnerability assessment
Components
3
Direct deps
1
Transitive deps
2
Total vulns
0
Format: CycloneDX 1.5 · Generated: Apr 1, 2026
Behavioral Fingerprint
Runtime performance baseline for drift detection
Samples
8
Error rate
0.0%
Peak memory
— MB
Avg CPU
—%
Response time distribution
Output size distribution
Fingerprint v1.0 · Baseline: Apr 1, 2026 · Status: baseline
Component Inventory
28 components composing this plugin
skills
14
agent
1
commands
3
hooks
2
scripts
8
skills (14)
agents (1)
commands (3)
hooks (2)
scripts (8)
Core skills library for Claude Code: TDD, debugging, collaboration patterns, and proven techniques
Interface
Aggregated instruction summary
Scope & Permissions
What this capability can and cannot access — derived from pipeline analysis
no
no
yes
yes
yes
no
Badge & Integration
Embed certification status in your README, docs, or CI pipeline
Certification Notes
Provenance observations from the pipeline
Publisher "Jesse Vincent" is not verified — first certification from this publisher
No SECURITY.md or SECURITY.txt file found — no published vulnerability reporting process
Single contributor — no peer review evidence in commit history
Package description appears to be boilerplate or template text
Signed Artifact
Certification provenance and verification metadata
The original instruction file with a certification footer appended. Replace the source file in your project so AI agents see the trust score, verification link, and SOP.
ES256-signed JWS artifact for programmatic verification. Use with the Fidensa MCP server or GitHub Action to validate integrity.
Pipeline Artifacts
Raw data files from this certification run — downloadable for independent verification
contract.json
Full unsigned contract
stage1-ingest.json
Ingest stage output
stage2a-sbom.json
SBOM generation results
stage2a-vulns.json
Vulnerability scan results
stage2b-security.json
Security scan results
stage3a-functional.json
Functional test results
stage3b-adversarial.json
Adversarial test results
stage3c-fingerprint.json
Behavioral fingerprint
stage4-certify.json
Certification decision + trust score
stage3a-measurements.json
Raw functional test measurements
stage3b-measurements.json
Raw adversarial test measurements
run-log.json
Pipeline execution log
Not all files may be present for every certification.