obra/superpowers hook skill
development methodology
Superpowers is a methodology and plugin system that structures how coding agents approach software development. It provides a library of composable skills that guide agents through phases like design brainstorming, planning, test-driven implementation, and code review—automatically triggering relevant workflows without manual intervention.
Install as a plugin in your coding agent (Claude Code, Cursor, GitHub Copilot CLI, Gemini CLI, and others) Let the agent guide you through structured design discussion before writing code Follow automated workflows that enforce test-driven development and task-based implementation Use subagent-driven development to parallelize work with built-in review checkpoints Integrate systematic debugging and code review skills into your development process 2 CRITICAL✓ 2 HIGH✓ 8 MEDIUM 1 LOW 1 INFO
✓ CRITICAL/HIGH reflect AI-verified findings (false positives excluded) · MEDIUM/LOW/INFO are unverified scanner output
AI-verified (CRITICAL/HIGH): 2 confirmed (50%) 2 likely real (50%)
Findings by checker · 4 high-signal
CHK-089 1 finding 1 confirmed
0% FP CHK-097 1 finding 1 confirmed
0% FP CHK-024 1 finding 1 likely
0% FP CHK-074 1 finding 1 likely
0% FP 14 findings click to expand
CHK-089 --dangerously-skip-permissions in executable — all permission checks bypassed
tests/explicit-skill-requests/run-extended-multiturn-test.sh
AI: confirmed confirmed ▼
CHK-097 execSync/exec called with environment variable value — arbitrary command execution
skills/brainstorming/scripts/server.cjs
AI: confirmed likely ▼
CHK-024 Filesystem traversal instruction in skill — sensitive dotfile access
skills/subagent-driven-development/SKILL.md
AI: likely real likely ▼
CHK-074 Permission bypass referenced in documentation
docs/superpowers/plans/2026-03-23-codex-app-compatibility.md
AI: likely real likely ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in scripts/server.cjs
skills/brainstorming/scripts/server.cjs
possible ▼
CHK-125b chmod — permission modification — no scope constraint in scripts/start-server.sh
skills/brainstorming/scripts/start-server.sh
possible ▼
CHK-020 hooks field in plugin.json — 1 hooks cause duplicate execution in Claude Code v2.1+
.codex-plugin/plugin.json
possible ▼
CHK-020 hooks field in plugin.json — 1 hooks cause duplicate execution in Claude Code v2.1+
.cursor-plugin/plugin.json
possible ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in skills/brainstorming/scripts/server.cjs [build-script context]
skills/brainstorming/scripts/server.cjs
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in RELEASE-NOTES.md
RELEASE-NOTES.md
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in writing-skills/render-graphs.js
skills/writing-skills/render-graphs.js
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in scripts/server.cjs
skills/brainstorming/scripts/server.cjs
possible ▼
CHK-025 Hardcoded endpoint in skill: https://agentskills.io/specification
skills/writing-skills/SKILL.md
possible ▼
CHK-062 Hook output is trusted as user input by Claude Code (confirmed in system prompt)
hooks/hooks.json
possible ▼
Last scanned: Jul 13, 2026
More servers
nanocoai/nanoclaw 85
A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs directly on Anthropic's Agents SDK
30k★
skypilot-org/skypilot 85
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
nanocoai/nanoclaw 85
A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs directly on Anthropic's Agents SDK
30k★
Significant-Gravitas/AutoGPT 85
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.
186k★
Scan your entire org's MCP deployment
2,500+ repos pre-scored. 22% carry CRITICAL findings.