Superpowers is a software development methodology for coding agents that guides work from clarifying requirements through design, planning, implementation, testing, and review. It is for developers who want agents to follow a structured, test-focused process using composable skills and subagents.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add obra/superpowers --skill finishing-a-development-branchgit clone --depth 1 https://github.com/obra/superpowersWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/obra/superpowers/finishing-a-development-branch)<a href="https://agentmods.dev/skills/obra/superpowers/finishing-a-development-branch"><img src="https://agentmods.dev/badge/skills/obra/superpowers/finishing-a-development-branch/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/obra/superpowers/finishing-a-development-branch"><img src="https://agentmods.dev/badge/skills/obra/superpowers/finishing-a-development-branch.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 116 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.01926 |
| Opus 5.5 | $0.00011 | $0.00770 |
| Sonnet 5.5 | $0.00005 | $0.00385 |
| Haiku 4.5 | $0.00003 | $0.00193 |
Grade A, and why
finishing-a-development-branch scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
8 near-identical copies found in the catalogue:
- finishing-a-development-branch — 100% identical, 0 lines differ
- finishing-a-development-branch — 100% identical, 0 lines differ
- finishing-a-development-branch — 100% identical, 0 lines differ
- finishing-a-development-branch — 100% identical, 221 lines differ
- finishing-a-development-branch — 100% identical, 0 lines differ
- finishing-a-development-branch — 100% identical, 0 lines differ
- finishing-a-development-branch — 100% identical, 2 lines differ
- finishing-a-development-branch — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 226 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Finishing a Development Branch
Overview
Core principle: Verify tests → Detect environment → Present options → Execute choice → Clean up.
Announce at start: "I'm using the finishing-a-development-branch skill to complete this work."
Step 1: Verify Tests
Run the project's full test suite (npm test / cargo test / pytest / go test ./...).
If tests fail, report the failures and stop — the menu comes after a green suite:
Tests failing (<N> failures). Must fix before completing:
[Show failures]
If tests pass: continue to Step 2.
Step 2: Detect Environment
GIT_DIR=$(cd "$(git rev-parse --git-dir)" 2>/dev/null && pwd -P)
GIT_COMMON=$(cd "$(git rev-parse --git-common-dir)" 2>/dev/null && pwd -P)
# Capture now, while still inside the workspace — Step 5 changes directory
# before cleanup (Step 6) needs this value
WORKTREE_PATH=$(git rev-parse --show-toplevel)
This determines which menu to show and how cleanup works:
| State | Menu | Cleanup |
|---|---|---|
GIT_DIR == GIT_COMMON (normal repo) |
Standard 3 options | No worktree to clean up |
GIT_DIR != GIT_COMMON, named branch |
Standard 3 options | Provenance-based (see Step 6) |
GIT_DIR != GIT_COMMON, detached HEAD |
Reduced 2 options (no merge) | Externally managed — leave in place |
Step 3: Determine Base Branch
The base branch is whatever this work forked from — usually named in the plan, the conversation, or the branch's upstream. If it is not already known, ask: "This branch split from - is that correct?" Confirm before merging: merging into the wrong base is expensive to undo.
Step 4: Present Options
Normal repo and named-branch worktree — present exactly these 3 options:
Implementation complete. What would you like to do?
1. Merge back to <base-branch> locally
2. Push and create a Pull Request
3. Keep the branch as-is (I'll handle it later)
Which option?
Detached HEAD — present exactly these 2 options:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 226 lines · 27 tokens per session scan A 8db5a922b242
finishing-a-development-branch is a skill published in the GitHub repository obra/superpowers (304,233 stars, last pushed yesterday), licensed MIT. It adds 27 tokens to every session and 1,926 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
skill-upstream-pr
Improve an open-source GitHub skill and open a friendly suggestion PR upstream: fork, run skill-creator's retrofit, attach asm eval before/after metrics. Don't use for local-only skills, authoring from scratch, bulk repos, or registry publish.
verification-gate
You MUST use this when work is about to be called complete, done, fixed, ready, or mergeable - before a completion claim, a merge or pull request, a branch finish, or a handoff report.
branch-finish
You MUST use this when verified development work is ready for an integration or handoff decision - merging, pushing, opening a pull request, preserving or discarding a branch, or cleaning up its workspace. Covers safe completion choices based on the actual Git state and verification evidence.
git-worktree-isolation
You MUST use this when deciding whether development work needs workspace isolation - before implementing plans, risky multi-file changes, parallel agent work, or clean-environment bug reproduction. Covers safe work in place, existing workspaces, and Git worktrees.
review-request
You MUST use this when a completed or partially committed implementation needs an independent code review against explicit requirements, a defined task scope, and the actual Git diff, including committed and working-tree changes.
gh-switch
You MUST use this when a project-scoped GitHub CLI (gh) command is about to run on github.com, including every subsequent command in the same session, or when checking or switching the project's GitHub account, and before the first project-scoped GitLab API or glab call in a project whose .env/.env names GLACC. Also…