# Superpowers 2

> Superpowers 2 is a community-maintained plugin from obra. Anomity scores its risk at 65 out of 100 (high). It matches 1 dangerous capability combination.

- **Canonical URL:** https://catalog.anomity.ai/plugin/superpowers-2
- **Kind:** Plugin
- **Publisher:** obra
- **Trust level:** community
- **Risk score:** 65/100 (high)
- **Website:** https://github.com/obra/superpowers
- **Repository:** https://github.com/obra/superpowers
- **Last updated:** 2026-09-02
- **JSON:** https://catalog.anomity.ai/api/entries/plugin/superpowers-2

## Description

The second-generation Superpowers plugin bundles skills together with hooks that enforce a structured test-driven workflow — parallel task execution, code review, and root-cause debugging — rather than leaving the agent to choose whether to follow the process.

Hooks are the meaningful difference from a plain skill library. A hook fires on an event such as a file write or session start, which means part of the plugin runs without the agent deciding to invoke it. That is what makes the workflow stick, and also what makes review important: a hook is code that executes on your machine on a trigger you did not explicitly approve each time. It declares filesystem read and write plus shell execution, inheriting the host agent's authority.

## Why it scored 65

The score starts at the catalog's neutral base of 50 and moves only through the signals below. The formula is published at https://catalog.anomity.ai/about — there is no model and no hidden heuristic.

| Signal | Contribution | Severity | Evidence |
| --- | --- | --- | --- |
| Established community project | -10 | trust offset |  |
| 2 high-risk capabilities: filesystem:write, shell:execute | +20 | critical |  |
| Persistence + execution risk (medium) | +5 | medium | Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts). |

Clamped result: **65/100**, band **high**.

## Capabilities

| Capability | Name | Security implication |
| --- | --- | --- |
| `filesystem:read` | Filesystem read | Can read files on the host system. Used for context, indexing, or analysis. |
| `filesystem:write` | Filesystem write | Can create, edit, or delete files on the host system. High-impact capability — anything from helpful edits to planting persistence. |
| `shell:execute` | Shell execution | Can run arbitrary shell commands. Combined with network access this becomes effectively a remote shell. |

## Dangerous combinations matched

### Persistence + execution risk (medium)

Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).

Capabilities: `shell:execute`, `filesystem:write`

## Related plugins

- [Everything Claude Code](https://catalog.anomity.ai/plugin/everything-claude-code) — risk 100 (critical)
- [Tons of Skills Marketplace](https://catalog.anomity.ai/plugin/tons-of-skills) — risk 100 (critical)
- [Superpowers](https://catalog.anomity.ai/plugin/superpowers) — risk 65 (high)
- [Szum-Tech Claude Plugins](https://catalog.anomity.ai/plugin/szum-tech-claude-plugins) — risk 65 (high)
- [Code Simplifier](https://catalog.anomity.ai/plugin/code-simplifier) — risk 50 (medium)
- [Marketing Skills](https://catalog.anomity.ai/plugin/marketing-skills) — risk 50 (medium)

---

Source: Anomity Catalog (https://catalog.anomity.ai/). Scoring methodology: https://catalog.anomity.ai/about. Machine-readable index: https://catalog.anomity.ai/llms.txt · https://catalog.anomity.ai/openapi.json