Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add procoders/superpowers-v --skill initgit clone --depth 1 https://github.com/procoders/superpowers-vWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/procoders/superpowers-v/init)<a href="https://agentmods.dev/skills/procoders/superpowers-v/init"><img src="https://agentmods.dev/badge/skills/procoders/superpowers-v/init/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/procoders/superpowers-v/init"><img src="https://agentmods.dev/badge/skills/procoders/superpowers-v/init.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00090 | $0.01875 |
| Opus 5.5 | $0.00036 | $0.00750 |
| Sonnet 5.5 | $0.00018 | $0.00375 |
| Haiku 4.5 | $0.00009 | $0.00187 |
Grade B, and why
init scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
`grep -ls '"stopReviewGate": *true' ~/.claude/plugins/data/codex-*/state/<name>-*/state.json <tmp>/codex-companion/<name>-*/state.json`. How it starts
The opening of the file, as written. The whole thing — 88 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Init
Set up this project for the Compound V cycle (brainstorm → build, where one builder researches, plans and codes → verify). Probe everything first, then show the user one message with the findings and every proposed change, numbered, and apply only what they approve. With --check, probe and report, and write nothing.
Commands. Run each command as one plain command line with literal values (the run id, real paths): no shell variables you set yourself, no ; or && chains, no $?, and no pipes or redirects (|, >, 2>&1): the one exception is the <<'REQUEST' heredoc that hands run start its request. The sandbox's auto-allow refuses compound commands, and sandbox.excludedCommands only matches a bare call.
1. Probes (write nothing)
Run these and keep the results:
git rev-parse --show-toplevel # a git repo
git rev-parse --verify -q HEAD # with a first commit
python3 -c 'import sys; print(sys.version_info >= (3, 9))' # True
codex --version # reviewer candidate
npx --no-install playwright --version # Playwright Test in this project
claude mcp list # a playwright or chrome-devtools MCP?
claude plugin list --json # is superpowers@claude-plugins-official enabled?
- No first commit, or not a git repo: stop and say so. The run record pins a base commit, so Compound V cannot run without one.
- Python below 3.9: stop, and name the interpreter found.
- Test command: detect one from
package.json(scripts.test→npm test),pyproject.toml/pytest.ini(python3 -m pytest), aMakefiletest:target (make test),go.mod(go test ./...) orCargo.toml(cargo test). With none, propose none, and the plan will set one per run. - Browser runner: Playwright Test in the project, or a Playwright / Chrome DevTools MCP in
claude mcp list. With none, the offer isclaude mcp add playwright -- npx @playwright/[email protected] --headless, plus a note that each web plan adds Playwright Test (@playwright/test) as a dev dependency for itslive_cmd. Without a browser, a web run ends incomplete unless the user waives the check. - Codex stop-review gate: the codex plugin keeps a per-project
stopReviewGateflag in its state file. With<name>the last part of the repo path and<tmp>the output ofpython3 -c 'import tempfile; print(tempfile.gettempdir())', check it withgrep -ls '"stopReviewGate": *true' ~/.claude/plugins/data/codex-*/state/<name>-*/state.json <tmp>/codex-companion/<name>-*/state.json. A hit means two Stop-time reviewers would both fire (Codex's gate and Compound V's refuse-once Stop hook). Warn, and suggest/codex:setup --disable-review-gatefor this project. - Existing files: read
.claude/compound-v.jsonand.claude/settings.jsonif they exist. Every write below is a merge into them. Never truncate either file.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 88 lines · 90 tokens per session scan B dfb2a0bbf51d
init is a skill published in the GitHub repository procoders/superpowers-v (42 stars, last pushed yesterday), licensed MIT. It adds 90 tokens to every session and 1,875 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-23.
Other skills, from other repositories
prep-pr-close-keyword-auto-closes-issue
Diagnose and prevent the trap where a scaffolding/prep/planning/handoff PR (one that ships a paste-ready prompt, an ADR, an implementation plan, or any docs-only artefact describing FUTURE work) contains a close-keyword like closes #N / fixes #N / resolves #N in its TITLE or BODY, which GitHub auto-applies at merge…
rule-cited-by-title-proposes-work-the-ledger-says-is-built
A standing rule ("no change to X until the owner has reviewed Y") cited from its TITLE, its id, or a peer's paraphrase instead of its recorded body — so a session proposes building Y when the shared ledger already carries Y as built and waiting on a human. The second half is a vocabulary trap: a status word that means…
project-init
Use when beads/Dolt database initialization fails, when bd commands return errors about missing databases, when setting up beads in a new project, or when recovering from diverged Dolt history. Handles fresh init, bootstrap from remote, and recovery workflows.
research-lane-coordinator
Coordinate research lanes, evidence and PR handoffs. Use for multi-session research; skip routine edits.
promote-idea
Converts an album idea from IDEAS.md into an actual album project in one step. Use when the user says "promote [idea title]", "turn idea into album", or "start working on [idea]".
customer-onboarding-and-implementation
Takes a new customer from signature to working — setting a definition of live that both sides agreed before the contract was signed, planning and staffing the implementation, running data migration and integration realistically, training the people who will actually use it, and handing over to the ongoing…