setup
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Suggests installing the 'superpowers' plugin from a GitHub repository (github.com/obra/superpowers) if it is missing, which is a common extensibility pattern for this toolset.
- [COMMAND_EXECUTION]: Uses standard shell commands to prepare the local environment, specifically creating the directory structure required for the tool's operation.
- [PROMPT_INJECTION]: Accesses project manifest files (e.g., package.json, Cargo.toml, go.mod) to automatically determine the project's technology stack. This represents an indirect prompt injection attack surface, as malicious content inside these untrusted project files could theoretically attempt to influence the agent's configuration logic.
Audit Metadata