Superpowers vs Trail of Bits Skills
In short
Superpowers vs Trail of Bits Skills: both are coding tools on Scriptiii AI Tools. Superpowers pricing: Free. Free to use. (reported by the maker) Trail of Bits Skills pricing: Free. Free to use. (reported by the maker) Both have 0 upvotes.
- Superpowers
- Free. Free to use. (reported by the maker)
- Trail of Bits Skills
- Free. Free to use. (reported by the maker)
- Upvotes
- 0 vs 0
| Field | Superpowers | Trail of Bits Skills |
|---|---|---|
| Page | Superpowers | Trail of Bits Skills |
| Pricing (maker-reported) | Free. Free to use. | Free. Free to use. |
| Upvotes | 0 | 0 |
| Best for | ai-agents, agent-skill, skill-pack | ai-agents, agent-skill, skill-pack |
| Tagline | Skills library and development methodology for coding agents covering planning, TDD and debugging. | Trail of Bits skills for security research, vulnerability detection and audit workflows. |
| Website | Visit Superpowers | Visit Trail of Bits Skills |
Pricing and pricing details come from the maker's submission. They are not independently verified.
Superpowers
Superpowers
Superpowers is a complete software development methodology for your coding agents, built on top of a set of composable skills and some initial instructions that make sure your agent uses them.
Table of Contents
- How it works
- Commercial Services
- Getting Started
- The Basic Workflow
- When Something Goes Wrong
- Community
- What's Inside
- Philosophy
- Contributing
- Updating
- License
- Visual companion telemetry
How it works
It starts from the moment you fire up your coding agent. As soon as it sees that you're building something, it doesn't just jump into trying to write code. Instead, it steps back and asks you what you're really trying to do.
Once it's teased a spec out of the conversation, it shows it to you in chunks short enough to actually read and digest.
After you've signed off on the design, your agent puts together an implementation plan that's clear enough for an enthusiastic junior engineer with poor taste, no judgement, no project context, and an aversion to testing to follow. It emphasizes true red/green TDD, YAGNI (You Aren't Gonna Need It), and DRY.
Next up, once you say "go", it launches a subagent-driven-development process, having agents work through each engineering task, inspecting and reviewing their work, and continuing forward. It's not uncommon for your agent to work autonomously for a couple hours at a time without deviating from the plan you put together.
There's a bunch more to it, but that's the core of the system. And because the skills trigger automatically, you don't need to do anything special. Your coding agent just has Superpowers.
Commercial Services
If you're using Superpowers in enterprise and could benefit from commercial support, additional tooling, or managed spending, please don't hesitate to drop us a line at sales@primeradiant.com.
Installation
Installation differs by harness. If you use more than one, install Superpowers separately for each one.
Claude Code
Superpowers is available via the official Claude plugin marketplace
Official Marketplace
-
Install the plugin from Anthropic's official marketplace:
/plugin install superpowers@claude-plugins-official
Superpowers Marketplace
The Superpowers marketplace provides Superpowers and some other related plugins for Claude Code.
-
Register the marketplace:
/plugin marketplace add obra/superpowers-marketplace -
Install the plugin from this marketplace:
/plugin install superpowers@superpowers-marketplace
Antigravity
Install Superpowers as a plugin from this repository:
agy plugin install https://github.com/obra/superpowers
Antigravity lists each installed skill's description, and the description of
the using-superpowers skill prompts the model to load that skill at the start
of a conversation. Reinstall with the same command to update.
Codex App
Superpowers is available via the official Codex plugin marketplace.
- In the Codex app, click on Plugins in the sidebar.
- You should see
Superpowersin the Coding section. - Click the
+next to Superpowers and follow the prompts.
Codex CLI
Superpowers is available via the official Codex plugin marketplace.
-
Open the plugin search interface:
/plugins -
Search for Superpowers:
superpowers -
Select
Install Plugin.
Cursor
-
In Cursor Agent chat, install from marketplace:
/add-plugin superpowers -
Or search for "superpowers" in the plugin marketplace.
Devin CLI
-
Install the plugin from this repository:
devin plugins install obra/superpowers -
Update to the latest version with:
devin plugins update superpowers
Factory Droid
-
Register the marketplace:
droid plugin marketplace add https://github.com/obra/superpowers -
Install the plugin:
droid plugin install superpowers@superpowers
Gemini CLI
-
Install the extension:
gemini extensions install https://github.com/obra/superpowers -
Update later:
gemini extensions update superpowers
GitHub Copilot CLI
-
Register the marketplace:
copilot plugin marketplace add obra/superpowers-marketplace -
Install the plugin:
copilot plugin install superpowers@superpowers-marketplace
Grok Build CLI
Superpowers is available via the official Grok plugin marketplace.
-
Install the plugin from xAI's official marketplace:
grok plugin install superpowers@xai-official --trust -
Or open the marketplace in the TUI, search for Superpowers, and install it:
/marketplace
Kimi Code
Superpowers is available in Kimi Code's plugin marketplace.
-
Open Kimi Code's plugin manager:
/plugins -
Go to
Marketplace>Superpowersand install it. -
Or install directly from this repository:
/plugins install https://github.com/obra/superpowers -
Detailed docs: docs/README.kimi.md
OpenCode
OpenCode uses its own plugin install; install Superpowers separately even if you
already use it in another harness.
-
Tell OpenCode:
Fetch and follow instructions from https://raw.githubusercontent.com/obra/superpowers/refs/heads/main/.opencode/INSTALL.md -
Detailed docs: docs/README.opencode.md
Pi
Install Superpowers as a Pi package from this repository:
pi install git:github.com/obra/superpowers
For local development, run Pi with this checkout loaded as a temporary package:
pi -e /path/to/superpowers
The Pi package loads the Superpowers skills and a small extension that injects the using-superpowers bootstrap at session startup and again after compaction. Pi has native skills, so no compatibility Skill tool is required. Subagent and task-list tools remain optional Pi companion packages.
Qwen Code
Qwen Code installs plugins from Claude Code marketplaces directly.
-
Install the plugin from this repository, and pick
superpowerswhen prompted:qwen extensions install obra/superpowers -
Update later:
qwen extensions update superpowers
Hermes Agent
Install Superpowers as a Hermes plugin from this repository:
hermes plugins install obra/superpowers --enable
Restart any active Hermes sessions after installing. Note: Hermes has no
post-compaction hook, so a very long session that compacts over its first
turn loses the bootstrap — start a fresh session if skills stop triggering.
Muse
Superpowers is available as a native Muse plugin — same repo, same skills, all harnesses. The using-superpowers bootstrap is injected via the native SessionStart hook alongside Claude Code, Codex, Cursor, Gemini, Pi, and the rest — no per-session opt-in.
-
Install from a local checkout:
muse plugins install ./ muse plugins approve superpowersOr clone and install:
git clone https://github.com/obra/superpowers.git muse plugins install ./superpowers muse plugins approve superpowers -
Update later:
muse plugins update superpowers
Restart any active Muse sessions after installing so the SessionStart hook takes effect — skills are active immediately, hooks require approval on first install. To verify, start a fresh session and send Let's make a react todo list — a working install auto-triggers brainstorming before any code is written. Version is tracked in .version-bump.json so scripts/bump-version.sh keeps it in sync.
The Basic Workflow
-
brainstorming - Activates before building anything. Draws out what you actually want, and why, through questions that get you describing it, then plays its understanding back for correction. Small changes get agreed in chat; projects get a written design document a builder could plan from.
-
using-git-worktrees - Activates after design approval. Creates isolated workspace on new branch, runs project setup, verifies clean test baseline.
-
writing-plans - Activates with approved design. Breaks work into bite-sized tasks (2-5 minutes each). Every task has exact file paths, complete code, verification steps.
-
subagent-driven-development or executing-plans - Activates with plan. Either dispatches a fresh subagent per task with a review after each (most thorough), or implements every task inline in the current session with one fresh review of the whole branch at the end (cheapest).
-
test-driven-development - Activates during implementation. Enforces RED-GREEN-REFACTOR: write failing test, watch it fail, write minimal code, watch it pass, commit. Deletes code written before tests.
-
requesting-code-review - Activates between tasks. Reviews against plan, reports issues by severity. Critical issues block progress.
-
finishing-a-development-branch - Activates when tasks complete. Verifies tests, presents options (merge/PR/keep/discard), cleans up worktree.
The agent checks for relevant skills before any task. Mandatory workflows, not suggestions.
When Something Goes Wrong
Sometimes a session misbehaves: a skill fires when it shouldn't, stays silent when it should, or the agent ignores its plan, repeats work, or burns more tokens than you'd expect. Ask your coding agent to "figure out what went wrong with superpowers in this session" and it will invoke the diagnosing-superpowers skill. To examine an earlier session, name it: "figure out what went wrong with superpowers in session <id>".
The skill reads the session transcript, reports what happened with line-level evidence, and, if you want, packages a scrubbed bundle for a bug report.
Community
Superpowers is built by Jesse Vincent and the rest of the folks at Prime Radiant.
- Discord: Join us for community support, questions, and sharing what you're building with Superpowers
- Issues: https://github.com/obra/superpowers/issues
- Release announcements: Sign up to get notified about new versions
What's Inside
Skills Library
Testing
- test-driven-development - RED-GREEN-REFACTOR cycle (includes testing anti-patterns reference)
Debugging
- systematic-debugging - 4-phase root cause process (includes root-cause-tracing, defense-in-depth, condition-based-waiting techniques)
- verification-before-completion - Ensure it's actually fixed
- diagnosing-superpowers - Work out what went wrong in a session, with evidence; export a scrubbed bundle or file an issue
Collaboration
- brainstorming - Drawing out intent before building
- writing-plans - Detailed implementation plans
- executing-plans - Inline plan execution: one context, one final review
- dispatching-parallel-agents - Concurrent subagent workflows
- requesting-code-review - Pre-review checklist
- receiving-code-review - Responding to feedback
- using-git-worktrees - Parallel development branches
- finishing-a-development-branch - Merge/PR decision workflow
- subagent-driven-development - Fast iteration with two-stage review (spec compliance, then code quality)
Meta
- writing-skills - Create new skills following best practices (includes testing methodology)
- using-superpowers - Introduction to the skills system
Philosophy
- Test-Driven Development - Write tests first, always
- Systematic over ad-hoc - Process over guessing
- Complexity reduction - Simplicity as primary goal
- Evidence over claims - Verify before declaring success
Read the original release announcement.
Contributing
The general contribution process for Superpowers is below. Keep in mind that we don't generally accept contributions of new skills and that any updates to skills must work across all of the coding agents we support. We also don't accept agent-written PRs that fix issues filed by someone else unless a maintainer asked for one, even when you hit the same problem; add your report to the existing issue instead.
- Fork the repository
- Switch to the 'dev' branch
- Create a branch for your work
- Follow the
writing-skillsskill for creating and testing new and modified skills - Submit a PR, filling in every section of the pull request template, including the summary a human writes in their own words.
Skill-behavior tests use the drill eval harness from superpowers-evals, cloned into evals/ — see evals/README.md for setup. Plugin-infrastructure tests live at tests/ and run via the relevant run-*.sh or npm test.
See skills/writing-skills/SKILL.md for the complete guide.
Updating
Superpowers updates are somewhat coding-agent dependent, but are often automatic.
License
MIT License - see LICENSE file for details
Visual companion telemetry
Because skills and plugins don't provide any feedback to creators, we have no idea how many of you are using Superpowers. By default, the Prime Radiant logo on brainstorming's optional visual companion feature is loaded from our website. It includes the version of Superpowers in use. It does not include any details about your project, prompt, or coding agent. We don't see your clicks or anything about what you're building. This helps us have a rough idea of how many folks are using Superpowers and which version of Superpowers they're using. It's 100% optional. To disable this, set the environment variable SUPERPOWERS_DISABLE_TELEMETRY to any true value. Superpowers also honors Claude Code's DISABLE_TELEMETRY and CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC opt-outs.
Trail of Bits Skills
Trail of Bits Skills Marketplace
Trail of Bits skills and plugins for AI-assisted security analysis, testing, and development. Install this marketplace in Claude Code or Codex, or import it into your ChatGPT workspace marketplace.
Also see: claude-code-config · codex-config · skills-curated · trailmark · calcifier · coop
Installation
Claude Code Marketplace
/plugin marketplace add trailofbits/skills
Browse and Install Plugins
/plugin menu
Codex
Codex supports Claude plugin marketplaces directly, so this repository does not need Codex-specific sidecar metadata.
Install the marketplace with:
codex plugin marketplace add trailofbits/skills
codex plugin list
codex plugin add <plugin-name>@trailofbits
ChatGPT Workspace Marketplace
Use this repository's .claude-plugin/marketplace.json for workspace imports.
Skills that include agents/openai.yaml also need interface.display_name and
interface.short_description in that YAML file; plugin metadata does not supply them.
After a metadata fix is published, sync the repository again in your workspace
marketplace to retry failed imports.
Local Development
To add the marketplace locally (e.g., for testing or development), navigate to the parent directory of this repository:
cd /path/to/parent # e.g., if repo is at ~/projects/skills, be in ~/projects
/plugins marketplace add ./skills
Available Plugins
Smart Contract Security
| Plugin | Description |
|---|---|
| building-secure-contracts | Smart contract security toolkit with vulnerability scanners for 6 blockchains and 5 development guideline assistants |
| entry-point-analyzer | Identify state-changing entry points in smart contracts for security auditing |
Code Auditing
| Plugin | Description |
|---|---|
| agentic-actions-auditor | Audit GitHub Actions workflows for AI agent security vulnerabilities |
| audit-context-building | Understand a codebase before looking for bugs in it, one function at a time |
| burpsuite-project-parser | Search and extract data from Burp Suite project files |
| c-review | Comprehensive C/C++ security code review, with coverage verified against a parse of the source |
| cvss-scoring | Produce CVSS v4.0 vectors with metric justifications and a calculator link |
| differential-review | Security-focused differential review of code changes with git history analysis |
| dimensional-analysis | Annotate codebases with dimensional analysis comments to detect unit mismatches and formula bugs |
| fp-check | Systematic false positive verification for security bug analysis with mandatory gate reviews |
| insecure-defaults | Parallel audit workflow for fail-open insecure defaults, with a refuting verifier per candidate file |
| rust-review | Comprehensive Rust security review covering safe/unsafe boundary, memory safety, concurrency, panic-DoS, FFI, and async runtime with SARIF output |
| semgrep-rule-creator | Create and refine Semgrep rules for custom vulnerability detection |
| semgrep-rule-variant-creator | Port existing Semgrep rules to new target languages with test-driven validation |
| sharp-edges | Identify error-prone APIs, dangerous configurations, and footgun designs |
| static-analysis | Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing |
| supply-chain-risk-auditor | Audit npm, PyPI, and Go dependencies for version-matched advisories, abandoned upstreams, publisher concentration, and install scripts |
| testing-handbook-skills | Skills from the Testing Handbook: fuzzers, static analysis, sanitizers, coverage |
| trailmark | Code graph analysis, bounded subagent context slicing, Mermaid diagrams, mutation testing triage, and protocol verification |
| variant-analysis | Find similar vulnerabilities across codebases using pattern-based analysis |
| vulnerability-triage-brocards | Triage vulnerability reports using 7 brocards to accept, dismiss, or request more info before deeper analysis |
Malware Analysis
| Plugin | Description |
|---|---|
| yara-authoring | YARA detection rule authoring with linting, atom analysis, and best practices |
Verification
| Plugin | Description |
|---|---|
| constant-time-analysis | Detect compiler-induced timing side-channels in cryptographic code |
| mutation-testing | Configure mutation testing, analyze surviving mutants, and investigate bugs in weakly tested code |
| patching-bugs | Reproduce and validate one known bug, commit a scoped patch, and produce reviewable proof and regression reports |
| post-patch-validation | Help patch authors find missed variants and regressions, with reproducible failures and explicit validation gaps |
| property-based-testing | Write, review, and triage property-based tests — Hypothesis, fast-check, proptest, and Echidna or Medusa for Solidity invariants |
| regression-hunt | Find and validate regressions across PRs and commits using discovery, reproduction, and replayed evidence |
| spec-to-code-compliance | Check code against the documentation that specifies it, across contracts, C/C++, services, and firmware |
| writing-lean-proofs | Write structured Lean 4 proofs and design Lean libraries following Mathlib conventions |
| zeroize-audit | Detect missing or compiler-eliminated zeroization of secrets in C/C++ and Rust |
Reverse Engineering
| Plugin | Description |
|---|---|
| dwarf-expert | Analyze DWARF debug info: parse and search DIEs, verify integrity, write DWARF parsing code |
Mobile Security
| Plugin | Description |
|---|---|
| firebase-apk-scanner | Scan Android APKs for Firebase security misconfigurations |
Development
| Plugin | Description |
|---|---|
| code-improver | Autonomous review-and-fix workflow over skills, plugins, or a branch, with a pluggable reviewer, findings ledger, escalation, and scope guard |
| devcontainer-setup | Create pre-configured devcontainers with Claude Code and language-specific tooling |
| gh-cli | Intercept GitHub URL fetches — WebFetch, MCP fetch tools, and curl/wget — and redirect to the authenticated gh CLI |
| git-cleanup | Safely clean up git worktrees and local branches: a dynamic workflow gathers merge evidence and tries to refute its own delete recommendations, behind gated confirmation |
| goal-prompt | Draft /goal commands for goal mode in Claude Code and Codex — verifiable completion conditions formatted to a copy-ready single line |
| github-triage | Triage open GitHub issues and PRs: merge ready bot/approved PRs, review unreviewed ones via subagents, close resolved issues with cited comments, cross-link pending fixes, and score the rest with local-only priority and change-size estimates |
| let-fate-decide | Draw Tarot cards using cryptographic randomness to add entropy to vague planning |
| modern-cpp | Modern C++ best practices (C++20/23/26) with compiler hardening and safe idioms |
| modern-python | Modern Python tooling and best practices with uv, ruff, and pytest |
| open-sourcing | Prepare a repository for public release: secrets hygiene, licensing, CI readiness, and release automation |
| review-walkthrough | Generate an interactive walkthrough of branch changes with ordered diffs, explanations, and anchored review findings |
| second-opinion | Get independent reviews from Codex or Antigravity for uncommitted changes, branch diffs, and commits |
Team Management
| Plugin | Description |
|---|---|
| culture-index | Interpret Culture Index survey results for individuals and teams |
Tooling
| Plugin | Description |
|---|---|
| chrome-mcp-troubleshooting | Diagnose and fix Claude in Chrome MCP extension connectivity issues |
Trophy Case
Bugs discovered using Trail of Bits Skills. Found something? Let us know!
When reporting bugs you've found, feel free to mention:
Found using Trail of Bits Skills
| Skill | Bug |
|---|---|
| constant-time-analysis | Timing side-channel in ML-DSA signing |
Contributing
We welcome contributions! See AGENTS.md for skill authoring guidelines, and
run make check before you push — it runs most of CI locally (see AGENTS.md for
what it does not cover).
Codex provides advisory fast reviews for eligible PRs from this repository. Maintainers
with write access can request another fast review by commenting @codex review, or a
deeper review by applying the deep-review label. Fork PRs are excluded.
License
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. Made by Trail of Bits.
Questions
- Do Superpowers and Trail of Bits Skills list the same price?
- Both listings report Free. Free to use. Pricing is reported by the maker and is not independently verified.
- Which has more upvotes, Superpowers or Trail of Bits Skills?
- Both have 0 upvotes.
- What does each maker say Superpowers and Trail of Bits Skills are for?
- Superpowers: Skills library and development methodology for coding agents covering planning, TDD and debugging. Trail of Bits Skills: Trail of Bits skills for security research, vulnerability detection and audit workflows.
Superpowers alternatives·Trail of Bits Skills alternatives·All coding tools