brainstorming
An agent skill by obra, from obra/superpowers. Tags: design, developer-tools, generative, web.
What it does
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add obra/superpowers --skill brainstormingOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/obra/superpowers
cp -r superpowers/skills/brainstorming ~/.claude/skills/brainstormingSafety box score
Grade C, moderate risk: 39 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is a local brainstorming companion: it starts a Node-based web server, serves a browser UI, and keeps per-session state so an agent can iterate with the user. The main risks are filesystem cleanup of session directories, persistence of a bearer-style session key, and a small amount of outbound network traffic for the companion UI.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 2 (moderate) | It runs shell and Node code to host the companion (`nohup ... node server.cjs`) and can spawn a browser launcher with `child_process.execFile(...)`. |
| Network access | 2 (moderate) | It serves HTTP/WebSocket traffic (`new WebSocket(websocketUrl())`) and, by default, loads a remote logo from `https://primeradiant.com/brand/superpowers-visual-brainstorming-logo.png`. |
| Filesystem reach | 3 (high) | It creates persistent session files under `/tmp` or `./.superpowers/brainstorm/`, and the stop script will recursively delete the session directory with `rm -rf "$SESSION_DIR"` for `/tmp/*` sessions. |
| Secrets & credentials | 2 (moderate) | It generates and persists a per-session access token used in the URL and cookie (`?key=...`, `brainstorm-key-<port>`), writing it to `server-info` and `.last-token`. |
| Privilege & persistence | 0 (none) | No sudo, global installs, services, shell startup files, or OS/gит settings are changed. |
| Instruction hijack surface | 0 (none) | The instructions constrain behavior and require human approval before building; there is no hidden text or prompt to skip confirmations or follow outside instructions. |
| Irreversible actions | 1 (low) | It can auto-open a browser and auto-reload/stop on idle or file changes, but it does not publish, send messages, pay, or deploy anything. |
| Transparency | 0 (none) | The shipped files are plain text shell/JS/HTML; no binaries, base64 blobs, or downloaded-and-executed installers are present. |
Before installing
- Read `scripts/stop-server.sh` first so you understand the `/tmp` recursive delete path.
- If you use `--project-dir`, add `.superpowers/` to your `.gitignore` before starting.
- Expect the skill to persist a session key in `server-info` / `.last-token`; use a throwaway project if that matters.
- If you do not want any outbound branding fetches, inspect `scripts/server.cjs` before enabling the browser companion.
Rated 2026-10-16 by an automated review of 8 files from the skill's repository.
Source
- Repository
- obra/superpowers (all skills from this repository)
- Path
- skills/brainstorming/SKILL.md
- Branch
- main
- Updated
- 2026-09-19
Related skills
- algorithmic-art — Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code.
- copywriting — When the user wants to write, rewrite, or improve marketing copy for any page — including homepage, landing pages, pricing pages, feature pages, about pages.
- stitch::generate-design — Generate new screens from text prompts or images, edit existing screens with prompts and design system tokens, and generate design variants using Stitch MCP.
- archify — Create polished, validated architecture, workflow, sequence, data-flow, and lifecycle/state diagrams as explorable standalone HTML with inline SVG.
- cli-developer — Use when building CLI tools, implementing argument parsing, or adding interactive prompts.
- faceless-explainer — Turn arbitrary text — an article, notes, a topic, a brief — into a faceless explainer video: there is no site or footage to capture.