Enable or disable a strict engineering workflow for coding tasks enforcing goal clarification, specs, planning, test-driven small steps, and verification.
Security Analysis
high confidenceThis instruction-only skill is internally consistent with its stated purpose: it enforces a coding workflow, stores a small mode file in agent memory, and does not request credentials or install software.
Name, description, and instructions align: a workflow helper for coding tasks that toggles behavior and uses reference templates. There are no unrelated env vars, binaries, or installs. Note: the skill has no public homepage or source URL (owner is an ID only), which reduces transparency but does not create a technical mismatch.
SKILL.md stays within scope: it reads/writes a single state file (memory/superpowers-mode.md), produces specs/plans, and restricts itself to coding/build/debug tasks. It does not request other files, credentials, or external endpoints. Note: it persists mode state in agent memory, which is expected behavior for a toggle.
No install spec and no code files — lowest-risk model (instruction-only). Nothing is downloaded or written to disk beyond the declared state file in agent memory.
No environment variables, credentials, or config paths are requested. The declared requirements are minimal and appropriate for the stated functionality.
The skill writes a small state file to memory (enabled:true/false) and confirms changes; it does not require always:true and does not modify other skills or system settings. Autonomous model invocation is allowed by default (disable-model-invocation is false), which is normal for skills and not by itself a concern.
Guidance
This skill appears coherent and low-risk: it only enforces a development workflow and stores a small mode file in agent memory. Before installing, consider: (1) the skill has no public homepage or source URL — if provenance matters to you, prefer skills with a visible maintainer; (2) the state file (memory/superpowers-mode.md) is persistent within the agent environment — if your agent shares memory across skills or sessions, check how that storage is protected; (3) the skill requests no credentials and performs no network or shell actions, so it cannot exfiltrate secrets on its own. If you’re comfortable with the unknown owner and agent memory usage, this skill is reasonable to enable.
Latest Release
v1.0.1
- Initial metadata file (_meta.json) added to the skill. - No changes to the functionality or workflow; this is a metadata update only.
More by @Spiceman161
Published by @Spiceman161 on ClawHub
