superpowers-orchestrator

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The workflow explicitly supports runtime ingestion of outsider-authored free text via “Connector execution” (Phase 4, Step 0), where it calls MCP connectors to fetch live data from external services/pages and passes that fetched text into the agent’s LLM context for subsequent skill execution.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The orchestrator explicitly plans to read full skill files and "run bundled scripts if applicable," and it lists a "Desktop Commander — Local file system, terminal, processes" connector, which enables executing arbitrary commands and modifying files (including actions that may require sudo), so it can push the agent to change the host machine's state.