Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-17
This package is a set of Markdown instructions for a structured software development workflow. It tells an agent to brainstorm and write a design or plan, then spawn subagents to implement tasks using test-driven development, with code reviews and final branch completion. It includes shell commands for running tests, using git, pushing code, creating pull requests, and deleting branches, but branch deletion and push/PR choices are presented for user confirmation. No hidden code, encoded blobs, credential access, payment instructions, or persistence were found. The observed behavior matches the declared purpose, though it needs shell, network, file-writing, and subagent capabilities and can perform destructive branch operations.
| Declared purpose | Spec-first, TDD, subagent-driven software development workflow for planning, implementing, debugging, and finishing coding tasks with tests, reviews, commits, and user gates. |
| Observed behavior | The skill instructs an agent to follow a five-phase pipeline: brainstorm, write plans, dispatch implementer and reviewer subagents with sessions_spawn, debug systematically, and finish branches. It directs writing design and plan files under docs/plans, running test commands such as pytest, pnpm test, cargo test, and go test, and running git commands including commit, merge-base, checkout, pull, merge, push, branch -d/-D, and gh pr create. User approval is required before coding, and exact confirmation is required before force-deleting a branch. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| shell | needed | Instructs running test commands and git commands including merge-base, checkout, pull, merge, push, branch -d/-D, and gh pr create. |
| filesystem_read | needed | Instructs exploring project context, reading files, docs, recent commits, git diff, and reviewing code. |
| filesystem_write | needed | Instructs writing design and plan files under docs/plans and performing git commits. |
| network | needed | Uses git push/pull and gh pr create for remote branch and PR operations; references clawhub.ai and github.com URLs. |
| other | needed | Uses sessions_spawn to create implementer, spec-reviewer, code-quality reviewer, and final reviewer subagents. |
| severity | finding |
|---|---|
| info | Requires execution and subagent tools The skill declares it needs shell command execution and the sessions_spawn tool to carry out its workflow. SKILL.md:10 Requires exec tool and sessions_spawn. |
| info | Writes design documents and commits The workflow creates files under docs/plans and commits them, so the agent needs filesystem write and git commit access. SKILL.md:38 5. Write design doc → `docs/plans/YYYY-MM-DD-<topic>-design.md` → commit |
| info | Spawns implementer subagents Uses sessions_spawn to create fresh subagents for implementation; reviewer subagents are also spawned in later steps. SKILL.md:69 1. `sessions_spawn` an implementer subagent with task + full plan context |
| low | Runs project test suites Instructs the agent to run project-specific test commands; other examples on nearby lines include pnpm test, cargo test, and go test. references/finishing-branch.md:17 pytest -q |
| medium | Pushes branches to remote If the user chooses Option 2, the agent pushes the feature branch to the git remote. references/finishing-branch.md:70 git push -u origin <feature-branch> |
| medium | Creates pull requests with GitHub CLI The agent may create a pull request on GitHub after pushing the branch. references/finishing-branch.md:71 gh pr create --title "<title>" --body "## Summary |
| info | Requires confirmation before discard Branch deletion is gated on the user typing the exact confirmation word. references/finishing-branch.md:94 Wait for exact word "discard". |
| medium | Force-deletes a branch Option 4 can permanently delete the feature branch and its commits after user confirmation. references/finishing-branch.md:97 git branch -D <feature-branch> |
| low | Commits code changes The plan template instructs frequent git commits after each passing test. references/writing-plans.md:59 `git add <files> && git commit -m "feat: <description>"` |
| info | Self-disclosed operational risk The skill card acknowledges that the workflow can perform high-impact git operations and recommends reviewing branch prompts before approving. skill-card.md:24 Risk: The workflow can run project tests, git commands, create commits, and guide branch merge, push, PR, or discard actions. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| github.com | not in the service index | SKILL.md:15 |
| Binaries invoked | bash, git, python |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 5 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 137 | 6519b20f4dae0f55… |
_meta.json | 6 | 403b4b802fa0709b… |
references/brainstorming.md | 41 | cc8d8c12a8bb1e22… |
references/finishing-branch.md | 113 | e1343098d799f9ea… |
references/subagent-development.md | 112 | 8a3bc330dd63b104… |
references/systematic-debugging.md | 99 | eefa17bd25120dc5… |
references/tdd.md | 107 | f76698a6d0c8b634… |
references/writing-plans.md | 80 | 347cda5f0167624e… |
skill-card.md | 63 | d58136d0b8cbd014… |
For agents
JSON: https://agenteconomy.report/k/superpowers.audit.json · badge: https://agenteconomy.report/k/superpowers.audited.svg ·
skill rating: /k/superpowers · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).