# Superpowers

> Superpowers is a community-maintained plugin from obra. Anomity scores its risk at 65 out of 100 (high). It matches 1 dangerous capability combination.

- **Canonical URL:** https://catalog.anomity.ai/plugin/superpowers
- **Kind:** Plugin
- **Publisher:** obra
- **Trust level:** community
- **Risk score:** 65/100 (high)
- **Website:** https://github.com/obra/superpowers
- **Last updated:** 2026-09-02
- **JSON:** https://catalog.anomity.ai/api/entries/plugin/superpowers

## Description

Superpowers is a community-maintained Claude Code plugin that ships a curated library of skills — short, structured workflows that the Claude Code agent follows for common engineering tasks like brainstorming, test-driven development, systematic debugging, finishing a development branch, and dispatching parallel agents. Once installed, the plugin auto-discovers its skills and exposes them through the standard Claude Code skill-invocation mechanism, so the agent can pick up the right one for the work at hand without the user having to remember command names.

Functionally, Superpowers reads files in the active project to determine context for each skill, writes edits, commits, and new files when the executing skill asks the agent to, and shells out to git, package managers, test runners, and other developer tools through the Claude Code Bash tool. It does not need separate credentials of its own — it inherits whatever Claude Code is already authorized to do — and it does not make network requests beyond what the underlying agent makes.

Superpowers is community trust because it is an independent open-source project rather than an official Anthropic plugin. The combination of filesystem write and shell execution lights up several risk signals in the catalog; the recommended posture is to review the bundled skill set before enabling auto-execution and to constrain the plugin's repository scope to the projects where its workflows are actively wanted.

## Why it scored 65

The score starts at the catalog's neutral base of 50 and moves only through the signals below. The formula is published at https://catalog.anomity.ai/about — there is no model and no hidden heuristic.

| Signal | Contribution | Severity | Evidence |
| --- | --- | --- | --- |
| Established community project | -10 | trust offset |  |
| 2 high-risk capabilities: filesystem:write, shell:execute | +20 | critical |  |
| Persistence + execution risk (medium) | +5 | medium | Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts). |

Clamped result: **65/100**, band **high**.

## Capabilities

| Capability | Name | Security implication |
| --- | --- | --- |
| `filesystem:read` | Filesystem read | Can read files on the host system. Used for context, indexing, or analysis. |
| `filesystem:write` | Filesystem write | Can create, edit, or delete files on the host system. High-impact capability — anything from helpful edits to planting persistence. |
| `shell:execute` | Shell execution | Can run arbitrary shell commands. Combined with network access this becomes effectively a remote shell. |

## Dangerous combinations matched

### Persistence + execution risk (medium)

Shell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).

Capabilities: `shell:execute`, `filesystem:write`

## Related plugins

- [Everything Claude Code](https://catalog.anomity.ai/plugin/everything-claude-code) — risk 100 (critical)
- [Tons of Skills Marketplace](https://catalog.anomity.ai/plugin/tons-of-skills) — risk 100 (critical)
- [Superpowers 2](https://catalog.anomity.ai/plugin/superpowers-2) — risk 65 (high)
- [Szum-Tech Claude Plugins](https://catalog.anomity.ai/plugin/szum-tech-claude-plugins) — risk 65 (high)
- [Code Simplifier](https://catalog.anomity.ai/plugin/code-simplifier) — risk 50 (medium)
- [Marketing Skills](https://catalog.anomity.ai/plugin/marketing-skills) — risk 50 (medium)

---

Source: Anomity Catalog (https://catalog.anomity.ai/). Scoring methodology: https://catalog.anomity.ai/about. Machine-readable index: https://catalog.anomity.ai/llms.txt · https://catalog.anomity.ai/openapi.json