Superpowers is a software development methodology for coding agents that guides work from clarifying requirements through design, planning, implementation, testing, and review. It is for developers who want agents to follow a structured, test-focused process using composable skills and subagents.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add obra/superpowers --skill diagnosing-superpowersgit clone --depth 1 https://github.com/obra/superpowersWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/obra/superpowers/diagnosing-superpowers)<a href="https://agentmods.dev/skills/obra/superpowers/diagnosing-superpowers"><img src="https://agentmods.dev/badge/skills/obra/superpowers/diagnosing-superpowers/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/obra/superpowers/diagnosing-superpowers"><img src="https://agentmods.dev/badge/skills/obra/superpowers/diagnosing-superpowers.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk warn
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00092 | $0.01635 |
| Opus 5.5 | $0.00037 | $0.00654 |
| Sonnet 5.5 | $0.00018 | $0.00327 |
| Haiku 4.5 | $0.00009 | $0.00163 |
Grade A, and why
diagnosing-superpowers scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 26d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
3 near-identical copies found in the catalogue:
- diagnosing-superpowers — 100% identical, 0 lines differ
- diagnosing-superpowers — 100% identical, 0 lines differ
- diagnosing-superpower — 94% identical, 16 lines differ
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Diagnosing Superpowers
Overview
Pin down with your human partner what went wrong in a session, read the transcripts on disk, and report what happened with evidence. You report; you do not diagnose superpowers. Whoever triages the bundle or the issue decides whether superpowers changes.
Core principle: Every finding cites path:line. No citation, no
finding. Every number comes from the transcript or from a command you ran,
never from memory.
Workflow
Create a todo per step. Steps 5–7 run only on their stated condition.
- Problem intake. Ask one question at a time until you can write a statement naming the session(s), the turn range if known, what your partner expected, what happened, and the observable they care about (wall-clock, tokens, repeated actions, one specific action). "It took too long" is a complaint, not a problem statement. Note whether the goal is a superpowers bug report.
- Locate. Resolve each session to verified absolute filesystem paths using
references/session-discovery.md. Confirm a past session by quoting its first prompt and timestamp, and list every candidate you rejected with the reason, or "none". Enumerate subagent transcripts. Create~/.superpowers/diagnosing-superpowers/<session-id>/, tell your partner the path, and filltemplates/case.mdthere, following its provenance rules for environment and skill observations. - Triage. Read the region around the reported problem yourself. Then
dispatch one analyst subagent per dimension in parallel, each given the
case file path,
prompts/analyst-common.md, and one dimension file fromprompts/:skill-timeline.md,plan-adherence.md,repeated-work.md,stumbles.md,quality-evidence.md,request-conflicts.md,cost-and-time.md. Split a dimension by turn range when the transcript is long. Discard any returned finding withoutpath:line. - Report. Fill every section of
templates/report.mdin order, write it to the workspace, show it, and give the path. Check what cited content actually proves and preserve the supporting case; a symlink alias is not a redundant copy. - GitHub issues — when report §7 says possible or likely, or your
partner asks. Search open and closed issues for the symptoms per
references/github-issues.md. Show matches and suggest adding the report to the closest. If none match, filltemplates/issue.md, write it to the workspace, show the exact text, and create the issue only after approval.ghcannot attach files; if a bundle exists, give your partner its path to attach in the browser. - Export — only when your partner asks for a bundle; never build one
unprompted. If the intake goal was a bug report, say once that a
scrubbed bundle is available on request, then wait. Ask the redaction
level, stating what each includes: skeleton (no tool-result bodies),
evidence (bodies only for cited events), full. Build the bundle per
templates/bundle-README.md, dispatchprompts/scrub.md, thenprompts/scrub-audit.md, repeating both until the audit returns CLEAN. Complete the bundle template's evidence check and reconciliation before showing the final scrub log, file list, and privacy and evidence outcomes. Archive (zip -rortar -czf) only after approval. With the archive path, state what it contains, point at the scrub log for replacements, and say scrubbing can miss things: they must review every file before sharing. - Similar sessions — when asked. Turn confirmed findings into a
signature, list candidates by mtime and size, find marker line numbers,
dispatch
prompts/similar-session.mdper candidate in parallel, and append report §9.
What ships with it
19 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- prompts/analyst-common.md 1.5 KB
- prompts/cost-and-time.md 1.6 KB
- prompts/plan-adherence.md 1.6 KB
- prompts/quality-evidence.md 1.4 KB
- prompts/repeated-work.md 1.4 KB
- prompts/request-conflicts.md 1011 B
- prompts/scrub-audit.md 1.3 KB
- prompts/scrub.md 1.4 KB
- prompts/similar-session.md 1.7 KB
- prompts/skill-timeline.md 1.6 KB
- prompts/stumbles.md 1.3 KB
- references/context-safety.md 990 B
- references/github-issues.md 1.6 KB
- references/redaction-policy.md 2.2 KB
- references/session-discovery.md 1.8 KB
- templates/bundle-README.md 3.6 KB
- templates/case.md 2.9 KB
- templates/issue.md 1.8 KB
- templates/report.md 2.3 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 26d ago First seen · 121 lines · 92 tokens per session scan A 5a652f8132cc
diagnosing-superpowers is a skill published in the GitHub repository obra/superpowers (299,875 stars, last pushed 6d ago), licensed MIT. It adds 92 tokens to every session and 1,635 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-20.
Other skills, from other repositories
coding-protocol
Risk-scaled repo execution and code-evidence protocol. Skip architecture-only work, explanation, contract-preserving prose, and status. Use for contract changes, debugging, code review, implementation plans, and Git mutation; mixed tasks: only those parts.
debugging
You MUST use this when investigating bugs, regressions, failing tests, build or integration failures, flaky behavior, performance anomalies, or other unexpected technical behavior.
inline-plan-dev
You MUST use this when executing an existing implementation plan directly in the current agent session, including resuming interrupted execution. Covers task-by-task implementation, plan drift, and verification. Not for subagent-driven execution.
debugging-and-error-recovery
Enforces a stop-the-line triage protocol across failure classes — test failures, build breaks, runtime errors, and production incidents — using bisection, safe-fallback design, and instrumentation lifecycle management. Use when any unexpected failure appears and the question is "what class of failure is this and…
go-expert
Use when writing or reviewing Go code that starts goroutines, holds a sync.Mutex/RWMutex, or closes channels - to enforce goroutine lifecycle ownership, lock-hygiene, and channel-close-side rules, and to wire up the detection tooling (go test -race, go vet, go.uber.org/goleak) that catches violations tests alone…
security-analysis
Runs a two-pass vulnerability scan on a snippet, file, or diff — a static pattern pass across fixed categories (injection, secrets, auth, crypto, deserialization, path traversal, resource exhaustion), then an LLM-reasoning pass for business-logic and race-condition flaws the patterns can't catch. Use for a dedicated…