obra-superpowers

This module appears to be a local screen-reload server with token/cookie authentication and a WebSocket channel that logs and persists client-sent events to disk. It does not clearly contain overt malware (no reverse shell, exfiltration, or dynamic code execution like eval). However, it has a high-impact risk: optional browser launching via cp.exec with BRAINSTORM_OPEN_CMD using shell-based execution; if an attacker can influence that env var in the runtime environment, it can become command injection leading to arbitrary command execution. Additionally, it persists and logs untrusted WebSocket messages without size/rate controls, creating potential disk-filling and data leakage risks.