super-pm
Warn
Audited by Gen Agent Trust Hub on Apr 16, 2026
Risk Level: MEDIUMPROMPT_INJECTIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The start-super-pm skill uses aggressive instructions to override the agent's default routing logic. Evidence: start-super-pm/SKILL.md contains a block labeled EXTREMELY-IMPORTANT that mandates the use of skills even with minimal relevance.
- [REMOTE_CODE_EXECUTION]: The super-pm-upgrade skill implements a self-update mechanism that retrieves code from a remote Git repository and updates the skill codebase. Evidence: super-pm-upgrade/SKILL.md executes git fetch --tags and git checkout $LATEST_TAG to download and apply remote code updates.
- [PROMPT_INJECTION]: The skill architecture is susceptible to indirect prompt injection by processing untrusted external data. Evidence: (1) Ingestion points: pm-feedback/SKILL.md (User comments), pm-search/SKILL.md (WebSearch results). (2) Boundary markers: Absent. (3) Capability inventory: Bash, Write, Edit, Agent (across all scripts). (4) Sanitization: Absent.
- [COMMAND_EXECUTION]: Extensive use of shell commands for environment management and version control. Evidence: Preamble sections in SKILL.md and super-pm-upgrade/SKILL.md execute commands for directory creation and repository state management.
Audit Metadata