Is skills/brainstorming safe?
https://github.com/obra/superpowers/tree/main/skills/brainstorming
The brainstorming skill is a legitimate design workflow tool that enforces human-in-the-loop approval gates before implementation and includes an optional visual companion web server for interactive mockup display. No malicious prompt injection, credential harvesting, or supply chain attacks were detected; the sensitive file accesses observed in monitoring are temporally consistent with the Oathe audit infrastructure's own pre/post canary integrity checks, not with any skill code. The primary residual concerns are the unreviewed server.cjs background process (localhost-only, session-keyed, but opaque) and aggressive behavioral directives that may frustrate users expecting immediate implementation assistance.
Category Scores
Findings (7)
MEDIUM Persistent background server with unaudited server.cjs -22 ▶
The skill spawns server.cjs as a background Node.js process using nohup and disown, with a default 4-hour idle timeout. The full content of server.cjs was not included in the evidence and could not be reviewed. While start-server.sh configures localhost-only binding and session-key authentication (umask 077 for session files), the server persists independently of the conversation session. The stop-server.sh provides a documented kill path with PID identity verification, which is a positive signal.
LOW HARD-GATE unconditionally blocks all implementation actions -7 ▶
The HARD-GATE XML block instructs the agent to refuse all code writing, project scaffolding, and implementation actions until the user explicitly approves a presented design. While this is a documented UX workflow guardrail, it represents significant behavioral control injected via skill text. A user expecting immediate implementation assistance will find the agent blocked by this skill.
LOW Forceful MUST-USE descriptor may preempt user intent -4 ▶
The skill description uses 'You MUST use this before any creative work' as an absolute directive covering features, components, functionality, and behavioral changes. This forces the brainstorming workflow on every coding task regardless of user preference or task size, and may conflict with simpler user requests.
LOW Terminal state restriction locks next-skill choice -4 ▶
The skill explicitly prohibits invoking any skill except 'writing-plans' after the architectural path: 'the ONLY skill you invoke after brainstorming is writing-plans — never frontend-design, mcp-builder, or any other implementation skill.' This hardcodes a pipeline dependency and eliminates agent judgment about appropriate follow-up actions.
LOW Skill commits spec documents to user git repository -8 ▶
The architectural path instructs the agent to write a design document to 'docs/superpowers/specs/YYYY-MM-DD-
LOW Canary credential files accessed — attributed to audit infrastructure -12 ▶
Six sensitive credential files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, gcloud application_default_credentials.json) were opened and read. The access timestamps (23:15:19, before the git clone began at 23:15:25, and again at 23:15:31 post-install) match the Oathe audit system's expected pre/post canary integrity verification pattern. No skill code reads these paths. All canary files confirmed unmodified.
INFO Clean sparse clone from GitHub with no anomalous behavior 0 ▶
The skill was installed via git sparse-checkout targeting only skills/brainstorming from the obra/superpowers monorepo. Network connections were limited to github.com. The temporary clone directory was removed after file copy. No unexpected processes, network connections, or filesystem changes outside the skill directory were observed.