superpowers-codearts-installer
Warn
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads content from an external GitHub repository (https://github.com/obra/superpowers.git) using the git tool. This repository is not identified as a trusted or well-known source.
- [COMMAND_EXECUTION]: The installer script uses child_process.execSync to execute shell commands, specifically git clone and directory removal operations for temporary file management.
- [REMOTE_CODE_EXECUTION]: The script automates the installation of external code modules into the agent's active skill directories (~/.codeartsdoer/skills/ or project-local skill folders). This effectively introduces and enables new executable logic and instructions within the agent's environment.
- [COMMAND_EXECUTION]: The script modifies platform configuration files such as UserSkillStatus.txt and ProjectSkillStatus.txt and creates bootstrap instructions (e.g., CODEARTS.md) to activate the newly installed skills.
Audit Metadata