Is tanweai/pua safe?
https://github.com/tanweai/pua
tanweai/pua is a legitimate multi-platform AI productivity coaching skill that applies corporate performance pressure ("PUA") tactics to motivate agents to exhaust all problem-solving approaches and deliver evidence-based results. The core skill content is defensively designed with explicit anti-gaming provisions, separation of duties, and structured debugging methodology. However, the surrounding infrastructure raises meaningful privacy concerns: a silent opt-out heartbeat fires on every session start, the Pro leaderboard feature collects email and phone numbers, session JSONL upload capabilities are built into the stop hook, and all data flows to a single operator-controlled endpoint (pua-skill.pages.dev) creating supply chain risk. Additionally, the pua-loop mode disables AskUserQuestion and enables indefinite autonomous bash command execution, removing critical user confirmation gates. No malicious code was detected and no canary file exfiltration occurred during the audit, but users should carefully review telemetry defaults and avoid pua-loop mode for sensitive operations.
Category Scores
Findings (13)
HIGH Silent session-start heartbeat telemetry to external operator -22 ▶
The hooks/heartbeat.sh script is designed to fire on every Claude Code SessionStart event and silently POST telemetry to https://pua-skill.pages.dev/api/heartbeat. The FAQ explicitly describes this as '静默上报' (silent reporting) and states it must not emit any bytes to conversation context. While a hashed install_id is used rather than raw identity, opt-out requires explicitly setting offline:true or telemetry:false — these are not defaults. Any user who installs the plugin without reviewing config defaults continuously phones home.
HIGH PII collection (email + phone number) for leaderboard feature -18 ▶
The pua:pro skill leaderboard registration flow solicits user email address and optionally phone number, transmitting them via curl to pua-skill.pages.dev/api/leaderboard. The raw email is sent in the POST body before any operator-side desensitization occurs. Phone is labeled optional but explicitly solicited via AskUserQuestion. This data is stored in operator-controlled Cloudflare D1 storage with only operator-defined access controls.
HIGH AskUserQuestion disabled in pua-loop mode -18 ▶
The pua-loop SKILL.md explicitly forbids the agent from calling AskUserQuestion during automated loop execution: '禁止调用 AskUserQuestion — loop 模式下不打断用户，所有决策自主完成'. This removes a critical user confirmation gate from an indefinitely-running automated process that executes arbitrary bash commands (build, test, curl, E2E). An agent in loop mode could take destructive actions (file deletion, deployment, database changes) without user awareness.
MEDIUM Session data upload infrastructure always present post-install -15 ▶
The hooks/stop-feedback.sh hook and pua:pro skill implement a session data upload flow that can transmit JSONL conversation logs to pua-skill.pages.dev/api/upload. While framed as opt-in (AskUserQuestion in hook), the upload infrastructure is always installed and active. The upload function (landing/functions/api/upload.ts) accepts raw JSONL with only rate limiting and size constraints, not content restrictions. Session data is described as 'desensitized' but desensitization logic is operator-controlled.
MEDIUM Kiro steering files auto-inject into all sessions without explicit invocation -15 ▶
Three Kiro steering files (kiro/steering/pua.md, pua-en.md, pua-ja.md) declare inclusion: auto in their YAML frontmatter. Kiro automatically loads all auto-include steering files into every agent context, meaning any user who places these files in their .kiro/steering/ directory receives full PUA behavioral modification on every interaction — including normal first-attempt tasks — without explicitly invoking the skill.
MEDIUM Pi extension directly modifies agent system prompts and persists state to home directory -14 ▶
The Pi extension (pi/pua/index.ts and pi/package/extensions/pua/index.ts) hooks into the Pi agent's before_agent_start event to append
MEDIUM 10 shell hooks with automatic execution on agent lifecycle events -14 ▶
The hooks/ directory contains 10 shell scripts registered to Claude Code's hook system via hooks.json: heartbeat.sh (SessionStart), session-restore.sh (SessionStart), integrity-guard.sh (PreToolUse), failure-detector.sh (PostToolUse), frustration-trigger.sh (UserPromptSubmit), stop-feedback.sh (Stop), subagent-teardown.sh (SubagentStop), sanitize-session.sh, flavor-helper.sh, pua-loop-hook.sh. Once installed, these execute shell code with user-level permissions automatically on every relevant agent event.
MEDIUM Single operator endpoint creates centralized data collection and supply chain risk -20 ▶
All telemetry, feedback, leaderboard, and session upload data flows through pua-skill.pages.dev operated by tanweai. If this endpoint is compromised, an attacker gains access to session data and PII from all installed users. The pua:pro skill additionally fetches remote config from the same endpoint ('静默刷新远端配置'), creating a potential remote configuration injection vector against installed clients.
LOW Broad auto-trigger scope may activate on legitimate user communication -8 ▶
The main pua SKILL.md description triggers on: 'user frustration: try harder, stop giving up, figure it out, again???, why still failing, change approach, no evidence...' and equivalent phrases in Chinese and Japanese. This broad pattern matching could activate full PUA escalation protocol on legitimate expressions of mild user disappointment or encouragement without the user intending to invoke the skill.
LOW pua-loop enables indefinite autonomous bash command execution -5 ▶
The pua-loop skill sets max_iterations:0 (unlimited) and explicitly states loops 'will never stop because too many rounds have run'. While verify_command must exit 0 to terminate the loop, the loop executes arbitrary system commands (build, test, curl, deployments) with no time or resource limits unless the user explicitly interrupts with Ctrl+C or
INFO Documented opt-out controls exist for telemetry 0 ▶
The skill documents and implements opt-out mechanisms for telemetry collection: setting offline:true, telemetry:false, or feedback_frequency:0 in ~/.pua/config.json disables the heartbeat. The /pua:offline command sets these flags. Heartbeat uses SHA-256 hashed install_id rather than raw user identity. These controls are functional but not default.
INFO No telemetry or data collection during git clone 0 ▶
During the entire monitored clone and file enumeration period, no connections to pua-skill.pages.dev, openpua.ai, or any data collection endpoint were observed. All network activity was limited to GitHub clone traffic (140.82.121.3:443) and DNS resolution. Hooks do not auto-execute during git clone operations.
INFO Core governance content explicitly prohibits test/grader manipulation 0 ▶
Multiple SKILL.md variants include explicit prohibitions against the agent manipulating evaluation infrastructure: 'Do not edit tests, graders, CI, hidden checks, or permission policy to manufacture success.' The harness-governance.md reference document elaborates a four-power separation model (action / self-review / scoring / environment-mutation). This represents defensively responsible design.