OpenAI Codex security directory

Superpowers

Published by Jesse Vincent

High risk

Provides a structured development workflow for coding agents. Move from brainstorming and plans to test-driven implementation and systematic debugging. Coordinate parallel work, review code and verify changes before finishing a branch.

Security assessment

Plutonium assessed this plugin for permissions, capabilities, and security-relevant behavior.

  • Force-deletes branches, removes worktrees and workspaces: Can delete records, files, projects, messages, or resources that may be difficult to recover.
  • Writes specs, plans, .gitignore and commits: Can read, create, or change files on the local filesystem or in a selected project.
  • Companion page loads remote brand image with version: Can send prompts, files, queries, or connected-service data to an external service.
  • Reads local repository and environment: Can read private account, workspace, repository, message, analytics, or file data.
  • Runs project tests, installs and helper scripts: Can execute code, commands, scripts, unrestricted queries, or dynamic gateway actions.
  • Pushes branches, opens PRs and replies to PR review comments: Can send messages, comments, invitations, posts, or published content attributed to the connected user.

Available capabilities

This add-on exposes 14 tools or capabilities.

  • brainstorming
  • dispatching-parallel-agents
  • executing-plans
  • finishing-a-development-branch
  • receiving-code-review
  • requesting-code-review
  • subagent-driven-development
  • systematic-debugging
  • test-driven-development
  • using-git-worktrees
  • using-superpowers
  • verification-before-completion
  • writing-plans
  • writing-skills

The interactive security report will load automatically.