
Product
Socket Threat Intel Now Shows Which Malware Campaigns Were Blocked or Detected
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.
@jasonfreelab/dsh-superpowers
Advanced tools
A DSH port of obra/superpowers — the full multi-agent software-development methodology (TDD, planning, debugging, review) as native DSH skills
English | 中文
A DSH (DeepSeek Harness) port of obra/superpowers — the full multi-agent software-development methodology, available out of the box as native DSH skills.
Ported from upstream obra/superpowers (v6.4.2, by Jesse Vincent / Prime Radiant). Skill content is taken directly from upstream and mapped onto the DSH toolset.
ctx.skills via a SkillProvider (rank 550; overridable by project/user skills).README.zh.md.lib/ is committed, so GitHub installs need no build step.release-please (versioning + CHANGELOG + release notes) plus trusted publishing to npm and GitHub Packages.Using the web profile as the example (change --profile for others). Requires Node >= 20, pnpm >= 9, and dsh.
# From npm (recommended)
dsh plugin --profile web add @jasonfreelab/dsh-superpowers
# Local path install (dev / offline)
git clone https://github.com/JasonFreeLab/dsh-superpowers.git && cd dsh-superpowers
pnpm install && pnpm build
dsh plugin --profile web add ./
# Verify: you should see id: superpowers
dsh --profile web --dump-config | grep -A2 '@jasonfreelab/dsh-superpowers'
# Update / uninstall
dsh plugin --profile web add @jasonfreelab/dsh-superpowers
dsh plugin --profile web remove @jasonfreelab/dsh-superpowers
Also published to GitHub Packages (requires auth):
npm.pkg.github.com/@jasonfreelab/dsh-superpowers.
dsh web (alias of dsh --profile web).ctx.skills and appear in the model's <available_skills> catalog — no extra setup.skill tool./skill-name, e.g. /superpower-brainstorming.Build me X → superpower-brainstorming → superpower-writing-plans → superpower-subagent-driven-development
Fix this bug → superpower-systematic-debugging
Review this → superpower-requesting-code-review
Session went wrong → superpower-diagnosing-superpowers
Verify: inside a session await ctx.skills.list({cwd}) should return 15 entries with provider: superpowers.
| Skill | When it triggers |
|---|---|
superpower-using-superpowers | Use when starting any conversation — establishes how to find and use skills, requiring skill invocation before ANY response including clarifying questions |
superpower-brainstorming | Use before any creative work — creating features, building components, adding functionality, or modifying behavior |
superpower-writing-plans | Use when you have a spec or requirements for a multi-step task, before touching code |
superpower-using-git-worktrees | Use when starting feature work that needs isolation from the current workspace, or before executing implementation plans |
superpower-executing-plans | Use when executing a plan inline in the current session as the implementer yourself — your human partner chose inline execution, or no subagent tool is available |
superpower-subagent-driven-development | Use when executing implementation plans with independent tasks in the current session |
superpower-dispatching-parallel-agents | Use when facing 2+ independent tasks that can be worked on without shared state or sequential dependencies |
superpower-test-driven-development | Use when implementing any feature or bugfix, before writing implementation code |
superpower-systematic-debugging | Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes |
superpower-verification-before-completion | Use before claiming work is complete, fixed, or passing — run verification commands and confirm output before any success claim |
superpower-requesting-code-review | Use when completing tasks, implementing major features, or before merging |
superpower-receiving-code-review | Use when receiving code review feedback, before implementing suggestions |
superpower-finishing-a-development-branch | Use when implementation is complete, all tests pass, and you need to decide how to integrate the work |
superpower-writing-skills | Use when creating new skills, editing existing skills, or verifying skills work before deployment |
superpower-diagnosing-superpowers | Use when a superpowers session went wrong (repeated work, ignored plans, stumbles, a skill that didn't fire, unexpected cost) — investigate it, or build a maintainer bug report |
Upstream references Claude Code tools; this package maps them onto DSH tools (see skills/superpower-using-superpowers/references/dsh-tools.md):
| Claude Code | DSH |
|---|---|
| Bash | bash |
| Read / Write / Edit | read / write / edit |
| Glob / Grep | glob / grep |
| TodoWrite | todo_write |
| Task (subagent) | subagent / subagent_fork |
| ExitPlanMode | exit_plan_mode |
| AskUserQuestion | ask_user_question |
| WebFetch / WebSearch | web_fetch / web_search |
| Present a deliverable | present |
| Read an image | read_image |
| Load a skill | skill tool / /name gesture |
src/superpowers.ts # SkillProvider (rank 550), lazily loads SKILL.md bodies
skills/ # 15 skills (English, with references/)
lib/ # build output (committed for zero-build installs)
scripts/ # test.mjs + verify.mjs
cordis.patch.yml # bundle patch
.github/workflows/ # ci.yml + release.yml + release-please.yml
pnpm install
npm run build # or: pnpm build
npm run typecheck
npm test # comprehensive (content hygiene + real SkillRegistry)
npm run verify # structural + runtime smoke
Issues and pull requests are welcome. The upstream methodology lives in obra/superpowers.
MIT, matching upstream obra/superpowers (Jesse Vincent / Prime Radiant).
FAQs
A DSH port of obra/superpowers — the full multi-agent software-development methodology (TDD, planning, debugging, review) as native DSH skills
The npm package @jasonfreelab/dsh-superpowers receives a total of 176 weekly downloads. As such, @jasonfreelab/dsh-superpowers popularity was classified as not popular.
We found that @jasonfreelab/dsh-superpowers demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.

Security News
Fixes for eMudhra and Brotli are out. Getting them everywhere they’re needed means tracking down bundled libraries, runtimes, and certificate stores.

Threat Research
/Security News
Socket uncovered secret-stealing workflows that ran in LiteLLM’s GitHub repository 11 days before the supply chain attack on PyPI and Docker.