Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add znlgis/opengis-skills --skill superpowers-zhgit clone --depth 1 https://github.com/znlgis/opengis-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/znlgis/opengis-skills/superpowers-zh)<a href="https://agentmods.dev/skills/znlgis/opengis-skills/superpowers-zh"><img src="https://agentmods.dev/badge/skills/znlgis/opengis-skills/superpowers-zh/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/znlgis/opengis-skills/superpowers-zh"><img src="https://agentmods.dev/badge/skills/znlgis/opengis-skills/superpowers-zh.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 37 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 67 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 84 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 94 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.01568 |
| Opus 5 | $0.00023 | $0.00784 |
| Sonnet 5 | $0.00009 | $0.00314 |
| Haiku 4.5 | $0.00005 | $0.00157 |
Grade A, and why
superpowers-zh scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 104 lines — stays where its author put it; the contents beside it link to each section on GitHub.
项目地址： https://github.com/jnMetaCode/superpowers-zh
英文上游： https://github.com/obra/superpowers
许可证： MIT ｜ npm 包： 参见 npm｜ 运行要求： Node.js ≥ 20
概述
superpowers-zh 不是代码库或语言框架，而是一套面向 AI 编程工具的「工作方式插件」：把工程实践固化为可被 AI 助手加载的 Skills，让 AI 在执行任务时先遵循流程、再生成代码。核心目标三句话：
- 让 AI 先想清楚再动手：不从模糊需求直接跳到编码，先澄清目的、约束、成功标准与可选方案。
- 让 AI 用工程纪律工作：用 TDD、系统化调试、完成前验证、代码审查约束「看起来能跑」的草率实现。
- 让中文团队直接落地：在完整汉化基础上补充中文代码审查、中文 Git 工作流、中文技术文档与提交规范等本土化能力。
包内含 skills/、agents/、commands/、hooks/ 与一键安装脚本 bin/superpowers-zh.js。它在 obra/superpowers（英文上游，250k+ ⭐）基础上完整汉化并新增 6 个中国原创 skills，支持 Claude Code / GitHub Copilot CLI / Hermes Agent / Cursor / Claw Code / Windsurf / Kiro / Gemini CLI / OpenCode / Qoder 等 20 款工具。
安装
# 一键安装（交互式选择目标 AI 工具并写入对应配置）
npx superpowers-zh
要求 Node.js ≥ 20。安装器会按所选工具把 skills/agents/commands/hooks 写入相应位置（如 Claude Code 的 plugin、Cursor 的 .cursor-plugin、OpenCode 的 .opencode/plugins、Codex 的 .codex-plugin、Gemini 的 gemini-extension.json 等）。
Skill 机制与方法论闭环
每个 Skill 都有名称 + 触发描述 + 详细流程。当 AI 工具支持 Skill 发现或自定义指令时，会在对应场景加载这些流程，用流程约束行动。核心方法论按软件交付链路组织：
| 阶段 | Skill 作用 |
|---|---|
| 需求澄清 | 先问清目的、约束、成功标准，避免基于模糊需求乱改 |
| 方案设计 / 计划编写 | 列出可选方案与权衡，产出可执行计划再动手 |
| TDD | 先写测试再实现，约束「看起来能跑」的实现 |
| 系统化调试 | 复现 → 定位根因 → 修复 → 回归测试，而非凭直觉乱试补丁 |
| 完成前验证 | 收尾前必须运行测试 / 构建 / lint，不说「应该好了」 |
| 代码审查与反馈处理 | 验证审查建议是否适用本代码库，而非盲目附和 |
| 分支收尾 | 规范提交、合并与分支清理 |
| 并行子智能体 / Git Worktree | 用子代理与 worktree 并行推进多任务 |
| 中国特色 Skills | 中文审查表达、提交规范、文档排版、国内 Git 平台流程、MCP 构建器、工作流执行器 |
using-superpowers 是入口型 Skill：引导 AI 在合适时机发现并加载其余技能。
典型工作流
1. npx superpowers-zh # 为你的 AI 工具安装中文方法论 Skills
2. 在 AI 工具中提出任务 → AI 先加载「需求澄清」Skill，问清目标与约束
3. 进入「方案设计 / 计划」Skill，产出方案与计划
4. 用「TDD」Skill 先写测试，再实现
5. 出 Bug 时走「系统化调试」Skill：复现→根因→修复→回归
6. 收尾用「完成前验证」运行测试/构建/lint，再用「代码审查」「分支收尾」收口
常见问题（FAQ）
| 问题 | 解决 |
|---|---|
| 它是模型或插件吗 | 都不是，是一套被 AI 加载的「方法论 Skills」，约束 AI 的工作流程 |
| 支持哪些工具 | Claude Code、Copilot CLI、Cursor、OpenCode、Hermes Agent、Windsurf、Gemini CLI、Kiro、Qoder 等 20 款 |
| 和英文 superpowers 区别 | 完整汉化 + 6 个中国原创 skills（中文审查/提交规范/文档排版/国内 Git 流程/MCP 构建器/工作流执行器） |
| 安装要求 | Node.js ≥ 20，npx superpowers-zh 一键安装 |
| AI 不触发 Skill | 确认工具支持 Skill 发现/自定义指令，并已写入对应配置；从 using-superpowers 入口引导 |
| 能和编码 Agent 一起用吗 | 可以，常与 OpenCode / Hermes Agent / Claude Code 搭配，作为「工作方式约束层」 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago First seen · 104 lines · 45 tokens per session scan A 9a625291e943
superpowers-zh is a skill published in the GitHub repository znlgis/opengis-skills (61 stars, last pushed yesterday), licensed MIT. It adds 45 tokens to every session and 1,568 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
implement-zh
An implementation workflow for completing work described in a specification or tickets. It encourages test-first development where appropriate, runs checks during the work, and ends with review and a commit.
code-quality-engineer
Consolidated code quality skill combining debugging, code review, and QA testing. Provides systematic root-cause analysis, architecture conformance checks, test strategy, and bug reporting. Ensures every feature meets quality bar. Combines: debugger + code-reviewer + qa-engineer.
write-code
Write code with quality process - TDD, reviews (uses code-writing skill).
sparc-methodology
SPARC (Specification, Pseudocode, Architecture, Refinement, Completion) comprehensive development methodology with multi-agent orchestration.
systematic-debugging
4-phase root cause debugging: understand bugs before fixing.
build-test
Run the project's build / typecheck / lint / test commands and emit the build.passing + tests.passing signals devloop convergence reads.