Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add znlgis/opengis-skills --skill superpowers-zhgit clone --depth 1 https://github.com/znlgis/opengis-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/znlgis/opengis-skills/superpowers-zh)<a href="https://agentmods.dev/skills/znlgis/opengis-skills/superpowers-zh"><img src="https://agentmods.dev/badge/skills/znlgis/opengis-skills/superpowers-zh/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/znlgis/opengis-skills/superpowers-zh"><img src="https://agentmods.dev/badge/skills/znlgis/opengis-skills/superpowers-zh.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 37 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 67 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 84 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 94 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.02204 |
| Opus 5.5 | $0.00018 | $0.00882 |
| Sonnet 5.5 | $0.00009 | $0.00441 |
| Haiku 4.5 | $0.00005 | $0.00220 |
Grade B, and why
superpowers-zh scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Enumerates other installed skillsmediumAgent snooping
Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.
ls .claude/skills # 按所选工具检查落盘位置 How it starts
The opening of the file, as written. The whole thing — 140 lines — stays where its author put it; the contents beside it link to each section on GitHub.
项目地址： https://github.com/jnMetaCode/superpowers-zh
英文上游： https://github.com/obra/superpowers
最新版本： npm 包 1.8.0（截至 2026-10，
npx superpowers-zh拉的就是它）；仓库 git tag 与 npm 版本号不同步，以 npm 为准许可证： MIT ｜ npm 包： 参见 npm｜ 运行要求： Node.js ≥ 20
概述
superpowers-zh 不是代码库或语言框架，而是一套面向 AI 编程工具的「工作方式插件」：把工程实践固化为可被 AI 助手加载的 Skills，让 AI 在执行任务时先遵循流程、再生成代码。核心目标三句话：
- 让 AI 先想清楚再动手：不从模糊需求直接跳到编码，先澄清目的、约束、成功标准与可选方案。
- 让 AI 用工程纪律工作：用 TDD、系统化调试、完成前验证、代码审查约束「看起来能跑」的草率实现。
- 让中文团队直接落地：在完整汉化基础上补充中文代码审查、中文 Git 工作流、中文技术文档与提交规范等本土化能力。
包内含 skills/、agents/、commands/、hooks/ 与一键安装脚本 bin/superpowers-zh.js。它在 obra/superpowers（英文上游）基础上完整汉化并新增 4 个中国原创 skills，全仓共 21 个 skills，覆盖 Claude Code / Copilot CLI / Hermes Agent / Cursor / Windsurf / Kiro / Gemini CLI / Codex / Aider / OpenCode / OpenClaw / DeepSeek Harness / Qoder / Trae 等 26 款工具（1.8.0 官方口径）。
安装
要求 Node.js ≥ 20（npm 包 superpowers-zh 的 engines 为 >=20.0.0）。
方式一：npx 直接跑（推荐）
# 交互式选择目标 AI 工具并写入对应配置
npx superpowers-zh
# 显式指定工具，不依赖自动识别
npx superpowers-zh --tool copilot
# 装到用户级目录（如 Hermes）
npx superpowers-zh --global --tool hermes
方式二：全局安装后用 superpowers-zh 命令
npm install -g superpowers-zh
superpowers-zh
验证
superpowers-zh --help # 打印可用参数（--tool / --global 等）
ls .claude/skills # 按所选工具检查落盘位置
安装器会按所选工具把 skills/、agents/、commands/、hooks/ 写入对应位置——1.8.0 的落盘目录按工具不同：Claude Code / Copilot CLI 用 .claude/skills/，Cursor 用 .cursor/skills/，Codex 用 .agents/skills/，Gemini CLI 用 .gemini/skills/，Hermes 用 ~/.hermes/skills/，Windsurf 用 .windsurf/skills/（全局 ~/.codeium/windsurf/skills/），Kiro 用 .kiro/skills/。
核心概念：Skill 机制与方法论闭环
每个 Skill 都有名称 + 触发描述 + 详细流程。当 AI 工具支持 Skill 发现或自定义指令时，会在对应场景加载这些流程，用流程约束行动。核心方法论按软件交付链路组织：
| 阶段 | Skill 作用 |
|---|---|
| 需求澄清 | 先问清目的、约束、成功标准，避免基于模糊需求乱改 |
| 方案设计 / 计划编写 | 列出可选方案与权衡，产出可执行计划再动手 |
| TDD | 先写测试再实现，约束「看起来能跑」的实现 |
| 系统化调试 | 复现 → 定位根因 → 修复 → 回归测试，而非凭直觉乱试补丁 |
| 完成前验证 | 收尾前必须运行测试 / 构建 / lint，不说「应该好了」 |
| 代码审查与反馈处理 | 验证审查建议是否适用本代码库，而非盲目附和 |
| 分支收尾 | 规范提交、合并与分支清理 |
| 并行子智能体 / Git Worktree | 用子代理与 worktree 并行推进多任务 |
| 中国特色 Skills | 4 个中国原创（chinese-code-review / chinese-git-workflow / chinese-documentation / chinese-commit-conventions，需 /chinese-* 手动调用）+ 2 个上游历史保留（MCP 构建器 / 工作流执行器） |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +26 lines scan A → B a5895421b8a6
- 12d ago Changed 9b71d01fe293
- 13d ago Changed · +10 lines 73d0cb7d750b
- 1mo ago Changed e0312d4c5ef4
- 1mo ago First seen · 104 lines · 45 tokens per session scan A 9a625291e943
superpowers-zh is a skill published in the GitHub repository znlgis/opengis-skills (75 stars, last pushed today), licensed MIT. It adds 45 tokens to every session and 2,204 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it B with 1 finding (enumerates other installed skills). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
tdd
A test-first development workflow that writes a failing test before the code, then makes it pass and improves the design.
debugging
Diagnose a failure, fix its root cause and verify the original scenario. Triggers on "debug", "调试".
code-quality-engineer
Consolidated code quality skill combining debugging, code review, and QA testing. Provides systematic root-cause analysis, architecture conformance checks, test strategy, and bug reporting. Ensures every feature meets quality bar. Combines: debugger + code-reviewer + qa-engineer.
software-development-workflows
Use when planning, debugging, testing, reviewing, simplifying, or spiking code changes across languages: systematic debugging, TDD, debugpy/Node inspectors, code cleanup, and implementation strategy.
implement-zh
An implementation workflow for completing work described in a specification or tickets. It encourages test-first development where appropriate, runs checks during the work, and ends with review and a commit.
write-code
Write code with quality process - TDD, reviews (uses code-writing skill).