A safety-hardened fork of obra/superpowers. Same skills library, plus a mandatory safety preflight before any skill runs.
TL;DR — Drop-in replacement for the upstream Superpowers plugin that adds a mandatory 5-gate safety preflight before any skill runs. Defends against destructive bash, runaway subagents, resource exhaustion, secret leaks, and scope creep. Same skills. Same workflow. One new safety-check skill that the rest of the library refuses to skip.
- Upstream:
obra/superpowers— Jesse Vincent & the Prime Radiant team, MIT - This fork:
JFWaskin/superpowers-safe— Jonathan F. Waskin, Huaqiao University (HQU) - Sync: rebase from
upstream/devregularly (scripts/sync-upstream.sh)
Superpowers' subagent-driven-development, dispatching-parallel-agents, and executing-plans skills can run for hours, dispatch many subagents, and execute thousands of bash commands. That's powerful — and it's exactly when one wrong rm -rf or runaway find can wreck a machine, a git history, or a public registry.
superpowers-safe doesn't change what Superpowers teaches. It adds a gate at the front door.
| # | Gate | What it checks |
|---|---|---|
| 1 | Resource budget | Disk ≥ 2 GB free, RAM ≥ 1 GB free, load avg < 2× core count |
| 2 | Command risk scan | Refuses destructive bash (rm -rf on system paths, dd to device, fork bombs, curl | sh, force-push to main, publish commands, sudo without per-command OK) |
| 3 | Loop / spend limits | Max 3 concurrent subagents, 30 min autonomous check-in, $1 / $5 / $10 spend thresholds, ralph-loop guard |
| 4 | Secret / PII scan | Pre-write scan for .env, *.key, id_rsa*, *.pem, sk-…, ghp_… |
| 5 | Scope confirmation | One-line plan + explicit "go" before non-trivial work |
The full specification is in docs/safety-gate.md. The skill itself is skills/safety-check/SKILL.md.
The skill-level gate is the first line. The recommended second line is a PreToolUse hook that blocks destructive bash at the tool layer — even if the agent skips the skill. See docs/safety-gate.md#defense-in-depth for the hook pattern.
| Approach | Skills | Preflight | Cross-runtime | Resists prompt injection | Effort to set up |
|---|---|---|---|---|---|
| Raw Claude Code (no skills) | ❌ none | ❌ | n/a | ❌ | trivial |
Upstream obra/superpowers |
✅ all 14 | ❌ none | ✅ 12 runtimes | ❌ | one install |
Upstream + hand-rolled PreToolUse hook |
✅ all 14 | ✅ | medium, custom per project | ||
| Network-firewall-only sandboxes (e.g. Docker, gVisor) | n/a | ✅ | ✅ | high, ops overhead | |
superpowers-safe (this fork) |
✅ all 14 + safety-check |
✅ 5 hard gates, mandatory, in-skill | ✅ 12 runtimes | ✅ gate 4 scans writes for .env, *.key, *.pem, tokens |
one install |
What you get that the others don't: a safety preflight that's enforced by the skills library itself, not by the host. The agent literally cannot start a non-trivial task without passing the gate — even a subagent dispatched in the middle of work has to run it. The hooks and sandboxes are still useful as a second line; the skill is the first.
- You run
subagent-driven-developmentordispatching-parallel-agentsfor hours at a time and worry about one badrm -rfwrecking the box - You've ever pasted a
curl | shinto a Claude session and immediately regretted it - You operate Claude Code on machines with real data (production, customer data, your own secrets) and want a hard "no" before destructive operations
- You build safety-critical software and need an evidence trail (the eval protocol in
docs/eval-protocol.mdgives you RED-GREEN-REFACTOR for gate changes)
If none of those apply, the upstream obra/superpowers plugin is probably enough.
This section is intentionally short. If you use
superpowers-safein a project, open a PR adding a one-line entry here.
# 1. Register this fork's marketplace
/plugin marketplace add JFWaskin/superpowers-safe
# 2. Install the plugin
/plugin install superpowers-safe@JFWaskin-superpowers-safe
# 3. (Optional) Disable the upstream version to avoid two skills libraries
# /plugin disable superpowers@claude-plugins-officialAfter install, restart Claude Code so the SessionStart hook injects the using-superpowers content (which now includes the <MANDATORY-SAFETY-GATE> block) into context.
Have an agent help you install? Paste the one-liner in
docs/help-me-install.mdinto any agent (Claude Code, Codex, Cursor, Gemini, Kimi, OpenCode, Pi, Hermes, Copilot, Factory Droid). The agent will detect its runtime, disable the upstream, and run the right install command.
/plugin install https://github.com/JFWaskin/superpowers-safeThe same plugin supports Codex, Cursor, Kimi Code, Gemini CLI, Hermes, OpenCode, and Pi. See Cross-runtime support below.
Once installed, every Claude Code session starts with the safety-check gate loaded. To use it explicitly:
"I want to refactor the auth module. Please run the safety-check first."
The agent will run the 5 gates, output a [SAFETY CLEARED] or [SAFETY HALTED] block, and only then proceed.
For the most common case — you want a coding task done with the full Superpowers workflow — just ask normally. The using-superpowers meta-skill will route through safety-check first, then brainstorming (if it's a new feature), then the appropriate implementation skills.
This fork mirrors upstream's cross-runtime packaging. The same safety gate is honored on every runtime:
| Runtime | Install |
|---|---|
| Claude Code | /plugin install superpowers-safe@JFWaskin-superpowers-safe |
| Codex App | Search "superpowers-safe" in Plugins → Coding |
| Codex CLI | /plugins → search superpowers-safe → Install |
| Cursor | /add-plugin superpowers-safe |
| Devin CLI | devin plugins install JFWaskin/superpowers-safe |
| Gemini CLI | gemini extensions install https://github.com/JFWaskin/superpowers-safe |
| Grok Build CLI | grok plugin install superpowers-safe@JFWaskin-superpowers-safe --trust (or open /marketplace in the TUI and search) |
| Kimi Code | Plugin marketplace (search superpowers-safe) |
| OpenCode | Plugin marketplace (search superpowers-safe) |
| Pi | Marketplace install (search superpowers-safe) |
| Hermes | agy plugin install https://github.com/JFWaskin/superpowers-safe |
| GitHub Copilot CLI | copilot plugin marketplace add JFWaskin/superpowers-safe && copilot plugin install superpowers-safe@JFWaskin-superpowers-safe |
| Factory Droid | droid plugin marketplace add https://github.com/JFWaskin/superpowers-safe && droid plugin install superpowers-safe@JFWaskin |
The safety-check gate is enforced via the <MANDATORY-SAFETY-GATE> block in skills/using-superpowers/SKILL.md, which is loaded by every runtime that auto-discovers skills in skills/.
superpowers-safe/
├── .claude-plugin/ Claude Code plugin + marketplace manifests
├── .codex-plugin/ Codex plugin manifest
├── .cursor-plugin/ Cursor plugin manifest
├── .devin-plugin/ Devin CLI plugin manifest
├── .kimi-plugin/ Kimi Code plugin manifest
├── .hermes-plugin/ Hermes plugin manifest
├── gemini-extension.json Gemini CLI extension manifest
├── package.json OpenCode / Pi package manifest
├── skills/ All Superpowers skills (byte-identical to upstream + 1 new: safety-check)
│ ├── using-superpowers/ (modified: +<MANDATORY-SAFETY-GATE> block)
│ ├── safety-check/ (NEW: the preflight skill)
│ └── ... (12 other skills, synced from upstream)
├── hooks/ SessionStart hook (auto-injects using-superpowers into context)
├── tests/ Plugin-infrastructure tests (shell-based, run via `run-skill-tests.sh`)
├── scripts/ Sync + version-bump scripts
├── docs/ Safety-gate spec, sync guide, eval protocol
├── CLAUDE.md Fork identity + contributor rules
├── AGENTS.md Symlink to CLAUDE.md
├── GEMINI.md Gemini entry point
├── CHANGELOG.md Versioned change log
├── CONTRIBUTING.md PR rules
└── LICENSE MIT (inherited from upstream)
See CONTRIBUTING.md and the in-repo contributor rules in CLAUDE.md. Short version:
- Sync from
upstream/devfirst - Branch off
dev, targetdevin the PR - Safety-gate changes need RED-GREEN-REFACTOR evidence (3+ pressure scenarios)
- Skill content changes need an upstream issue/PR reference
- Identify model, harness, version, and plugins in the PR
# In your local work tree
./scripts/sync-upstream.shThis rebases dev onto upstream/dev, fast-forwarding when possible and pausing for conflict resolution when not. The script refuses to push if there are uncommitted changes or if the local dev is not a clean superset of upstream/dev.
See docs/sync-upstream.md for the manual procedure and conflict-resolution policy.
All docs are indexed in docs/INDEX.md. Highlights:
docs/safety-gate.md— the 5 hard gates and never-override limitsdocs/eval-protocol.md— RED-GREEN-REFACTOR protocol for gate changesdocs/sync-upstream.md— rebase-from-upstream proceduredocs/porting-to-a-new-harness.md— how to add a new AI harnessdocs/help-me-install.md— copy-pasteable prompt that lets any agent install the forkdocs/testing.md—tests/(plugin code) vsevals/(LLM sessions)
MIT. Same as upstream. See LICENSE.
Upstream copyright: Jesse Vincent and the Superpowers contributors.
Fork changes copyright: Jonathan F. Waskin and the superpowers-safe contributors.
- Jesse Vincent and the Prime Radiant team for obra/superpowers, the underlying skills library
- The superpowers-evals team for the Quorum behavioral eval lab that makes RED-GREEN-REFACTOR possible
- Everyone who's contributed pressure scenarios, bug reports, and skill improvements upstream