using-superpowers
An agent skill by obra, from obra/superpowers. Tags: api, developer-tools, web.
What it does
Use when starting any conversation - establishes how to find and use skills, requiring skill invocation before ANY response including clarifying questions
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add obra/superpowers --skill using-superpowers
Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/obra/superpowers
cp -r superpowers/skills/using-superpowers ~/.claude/skills/using-superpowers
Safety box score
Grade C, moderate risk: 26 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is mostly a bootstrap and routing layer: it tells the agent how to find, invoke, and sequence other skills across supported harnesses. The main risk is instruction hijacking/overreach — it strongly pressures the agent to invoke skills before any response and to treat skill use as mandatory whenever there is even a 1% chance it applies.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 0 (none) | No shell commands, code execution, or script evaluation are present in `SKILL.md` or the referenced markdown files. |
| Network access | 0 (none) | The skill does not fetch remote content or send data off-machine; it only references local skill and config paths. |
| Filesystem reach | 2 (moderate) | It points the agent at home-directory dotfiles and skill stores such as `~/.codex/config.toml`, `~/.gemini/GEMINI.md`, `~/.gemini/skills/`, `~/.agents/skills/`, and `~/.hermes/SOUL.md`. |
| Secrets & credentials | 0 (none) | It does not ask for passwords, tokens, browser sessions, or other credentials. |
| Privilege & persistence | 0 (none) | There is no sudo, service registration, shell startup modification, or other privilege-changing action in the skill text. |
| Instruction hijack surface | 3 (high) | It tries to override normal agent behavior with mandates like `If you think there is even a 1% chance a skill might apply... you ABSOLUTELY MUST invoke the skill` and `Invoke relevant or requested skills BEFORE any response or action`. |
| Irreversible actions | 1 (low) | It adds process requirements like announcing `Using [skill] to [purpose]` and creating todos, but it does not itself push, delete, post, or otherwise act on external systems. |
| Transparency | 0 (none) | All shipped files are plain readable markdown; there are no binaries, encoded blobs, or downloaded installers. |
Before installing
- Read `SKILL.md` and decide whether you are comfortable with the assistant being told to invoke skills before any reply.
- Check whether the referenced home-directory paths (`~/.codex/`, `~/.gemini/`, `~/.hermes/`, `~/.agents/`) exist and contain personal config you do not want the agent to inspect.
- If you use a different harness, confirm its local skill resolution behavior so the bootstrap does not unexpectedly broaden filesystem access.
Rated 2026-10-19 by an automated review of 8 files from the skill's repository.
Source
- Repository
- obra/superpowers (all skills from this repository)
- Path
- skills/using-superpowers/SKILL.md
- Branch
- main
- Updated
- 2026-09-19
Related skills
- executing-plans — Use when executing an implementation plan in the current session as the implementer yourself — your human partner chose inline execution.
- finishing-a-development-branch — Use when implementation is complete, all tests pass, and you need to decide how to integrate the work
- receiving-code-review — Use when receiving code review feedback, before implementing suggestions.
- requesting-code-review — Use when completing tasks, implementing major features, or before merging to verify work meets requirements
- systematic-debugging — Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes
- test-driven-development — Use when implementing any feature or bugfix, before writing implementation code