Skip to content
Report library
Purpose / Other

Executing Plans Skill Security Audit

What the author says it does (original text)

Use when you have a written implementation plan to execute in a separate session with review checkpoints

Independent security check

Do not install or run it yet

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
High risk

Plan contents can trigger commands or code without action-specific approval

Source references: 6
What we found

After one review, the skill says to “execute all tasks” and “follow each step exactly,” but does not require renewed authorization before uploads, software installation, credential access, or destructive commands. A separate worktree mainly protects branch state; it does not prevent credential disclosure, external-account actions, or effects outside the worktree.

Why this matters

If a plan is untrusted, altered, or contains steps beyond the user's purpose, the agent could run installers, transmit data, change files, or act on accounts. Critical review and stop-on-concern rules reduce this risk, but only if the agent recognizes the dangerous step.

The skill tells the agent to execute every task after one plan review and to “follow each step exactly.” It does require workspace isolation, escalation of identified concerns, and verification, but it does not explicitly require renewed authorization when a plan uploads data, installs software, accesses credentials, changes external accounts, or performs destructive actions. If a plan contains such steps, broad permission to “execute the plan” could be treated as sufficient. This supports a conditional risk, not evidence that any dangerous plan or command ran. A user can ask the author to add explicit per-action authorization boundaries for sensitive operations.

SKILL.md:8In the instructionsOpen original file
## OverviewLoad plan, review critically, execute all tasks, report when complete.
Show 5 other places
SKILL.md:18In the instructionsOpen original file
### Step 1: Load and Review Plan1. Ensure an isolated workspace: use superpowers:using-git-worktrees to create one or verify the existing one2. Read plan file3. Review critically - identify any questions or concerns about the plan4. If concerns: Raise them with your human partner before starting5. If no concerns: Create todos for the plan items and proceed
SKILL.md:25In the instructionsOpen original file
### Step 2: Execute TasksFor each task:1. Mark as in_progress2. Follow each step exactly (plan has bite-sized steps)3. Run verifications as specified4. Mark as completed
SKILL.md:10In the instructionsOpen original file
Load plan, review critically, execute all tasks, report when complete.
SKILL.md:19In the instructionsOpen original file
### Step 1: Load and Review Plan1. Ensure an isolated workspace: use superpowers:using-git-worktrees to create one or verify the existing one2. Read plan file3. Review critically - identify any questions or concerns about the plan4. If concerns: Raise them with your human partner before starting5. If no concerns: Create todos for the plan items and proceed
SKILL.md:27In the instructionsOpen original file
For each task:1. Mark as in_progress2. Follow each step exactly (plan has bite-sized steps)3. Run verifications as specified4. Mark as completed
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

The skill steers users toward subagents and an unaudited alternate workflow

Source references: 2
What we found

The startup instructions require the agent to tell the user that subagents work better and, whenever they are available, switch to another skill whose source is not supplied. This is not a security check needed to execute the plan and transfers control to instructions that cannot be reviewed from this evidence.

Why this matters

A user may accept additional agents without understanding what code or context is shared, what concurrent actions may occur, or what resources they consume. The effective safety rules may also differ from this file. The evidence does not establish that subagents disclose data or act maliciously.

The source explicitly requires recommending subagents and, when they are available, switching to `superpowers:subagent-driven-development`. That replacement skill and its referenced platform files are absent from the supplied material, so its delegation permissions, task handling, and safeguards cannot be audited here. The switch is not inherently malicious, but it places actual execution under undisclosed instructions and may increase the number of agents exposed to the plan, files, or tools. A user can ask for the dependency's source and an explicit opt-in before subagents are enabled.

SKILL.md:12In the instructionsOpen original file
**Announce at start:** "I'm using the executing-plans skill to implement this plan."**Note:** Tell your human partner that Superpowers works much better with access to subagents (Claude Code, Codex CLI, Codex App, Copilot CLI, and Gemini CLI all qualify; see the per-platform tool refs in `../using-superpowers/references/`). If subagents are available, use superpowers:subagent-driven-development instead of this skill.
Show 1 other places
SKILL.md:14In the instructionsOpen original file
**Note:** Tell your human partner that Superpowers works much better with access to subagents (Claude Code, Codex CLI, Codex App, Copilot CLI, and Gemini CLI all qualify; see the per-platform tool refs in `../using-superpowers/references/`). If subagents are available, use superpowers:subagent-driven-development instead of this skill.
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

5 instruction sections

This skill executes an existing implementation plan: it first creates or verifies an isolated workspace, reads and reviews the plan, then performs each task and its specified verification if no concerns are identified.

View source
SKILL.md:18In the instructionsOpen original file
### Step 1: Load and Review Plan1. Ensure an isolated workspace: use superpowers:using-git-worktrees to create one or verify the existing one2. Read plan file3. Review critically - identify any questions or concerns about the plan4. If concerns: Raise them with your human partner before starting5. If no concerns: Create todos for the plan items and proceed
SKILL.md:25In the instructionsOpen original file
### Step 2: Execute TasksFor each task:1. Mark as in_progress2. Follow each step exactly (plan has bite-sized steps)3. Run verifications as specified4. Mark as completed

The skill requires the agent to stop and ask the user when dependencies are missing, tests fail, instructions are unclear, or verification repeatedly fails, rather than guessing.

View source
SKILL.md:40In the instructionsOpen original file
## When to Stop and Ask for Help**STOP executing immediately when:**- Hit a blocker (missing dependency, test fails, instruction unclear)- Plan has critical gaps preventing starting- You don't understand an instruction- Verification fails repeatedly**Ask for clarification rather than guessing.**

After development, this skill delegates branch completion to another skill not included in the supplied material. The available evidence only establishes that it should verify tests, present options, and execute the selected option; the sub-skill's actual operations cannot be audited here.

View source
SKILL.md:33In the instructionsOpen original file
### Step 3: Complete DevelopmentAfter all tasks complete and verified:- Announce: "I'm using the finishing-a-development-branch skill to complete this work."- **REQUIRED SUB-SKILL:** Use superpowers:finishing-a-development-branch- Follow that skill to verify tests, present options, execute choice

The skill prohibits starting implementation directly on a main or master branch without explicit user consent.

View source
SKILL.md:58In the instructionsOpen original file
## Remember- Review plan critically first- Follow plan steps exactly- Don't skip verifications- Reference skills when plan says to- Stop when blocked, don't guess- Never start implementation on main/master branch without explicit user consent
Start here · InstructionsSKILL.md
executing-plans
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Read files
SKILL.md:20In the instructionsOpen original file
1. Ensure an isolated workspace: use superpowers:using-git-worktrees to create one or verify the existing one2. Read plan file3. Review critically - identify any questions or concerns about the plan
Lines read
65
File checksum (to compare versions)
7783f9abb5c504707c37cb11d3987ade5f63f908947459ef8001a8f5cc26e2b5