# Claude Superpowers Architect

> use this skill when designing, auditing, upgrading, or hardening a claude, claude code, or agentic coding plugin/extension sometimes called superpowers. use for requests involving plugin architecture, commands, hooks, mcp tools, subagents, skills, context files such as claude.md or agents.md, workflow design, edge case handling, real business use cases, tool safety, prompt injection defense, release readiness, or converting a rough plugin idea into a production-ready implementation plan.

- Skill: `galihadiprayoga/claude-superpowers-architect` (Agent Skill, multi-file: 9 files)
- Install (CLI): `npx skillmds@latest add galihadiprayoga/claude-superpowers-architect`
- Raw SKILL.md: https://api.skillmd.com/api/skills/galihadiprayoga/claude-superpowers-architect/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: GalihAdiPrayoga (https://skillmd.com/u/galihadiprayoga)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/galihadiprayoga/claude-superpowers-architect

---


# Claude Superpowers Architect

## Purpose

Upgrade a Claude or Claude Code plugin/extension from a rough idea into a real-case-ready system. Focus on practical architecture, workflow reliability, edge cases, MCP/tool safety, context files, subagents, validation, and release readiness.

## Operating Principles

- Treat every feature as a workflow, not just a prompt.
- Separate capability design from implementation detail.
- Prefer explicit decision trees, checklists, and examples over vague advice.
- Surface risk early: unsafe tools, ambiguous permissions, missing fallback, hidden prompt injection paths, poor context loading, and missing tests.
- Do not assume a plugin is production-ready just because it has many commands or prompts.
- When the user provides a zip, folder tree, repository excerpt, README, manifest, command list, MCP config, hook config, or context file, ground the audit in that input.
- If the user only gives an idea, produce a proposed architecture and implementation roadmap instead of pretending to audit existing files.

## Input Handling

1. Determine the input type:
   - Existing plugin folder or zip: inspect structure and run `scripts/plugin_audit.py` when file access is available.
   - Pasted README, manifest, config, or code snippets: audit the provided content manually using the rubrics.
   - Rough product idea: convert it into a capability map, workflow matrix, edge-case plan, and build roadmap.
   - Existing skill or prompt pack: evaluate it as a plugin component and recommend where it belongs.

2. Identify the target runtime:
   - Claude Code plugin or command pack.
   - MCP server/tool pack.
   - Hook-based automation.
   - Subagent or role pack.
   - Context-file system such as `CLAUDE.md`, `AGENTS.md`, project rules, or memory files.
   - Hybrid plugin combining several of the above.

3. Ask at most three clarifying questions only when the target is impossible to infer. Otherwise make assumptions explicit and continue.

## Core Workflow

### Step 1: Map capabilities

Create a capability map with these categories:

- User-facing commands: what the user invokes directly.
- Automated hooks: what runs on events such as file change, pre-commit, pre-tool-use, or post-tool-use.
- MCP tools: external capabilities, data access, or actions requiring clear permissions.
- Subagents: delegated roles such as planner, implementer, reviewer, tester, security auditor, release manager.
- Context files: repository rules, product constraints, coding standards, architecture docs, user preferences.
- Skills or reusable workflows: repeatable procedures used across projects.
- Validation layer: tests, dry-runs, schema checks, safety checks, and post-action verification.

Use `references/architecture-rubric.md` for scoring and upgrade criteria.

### Step 2: Convert features into real-case workflows

For each major capability, define:

- Trigger: when the capability activates.
- Input: what the user, repo, file, tool, or event provides.
- Preconditions: required files, dependencies, permissions, secrets, network access, or project state.
- Action steps: concrete sequence the agent should follow.
- Validation: how success is checked.
- Failure handling: what to do when the ideal path breaks.
- Output: artifact, code change, report, command result, or user-facing response.

Use `references/real-case-patterns.md` when the user asks for workflow design, feature expansion, or business realism.

### Step 3: Stress-test edge cases

Always test the design against at least these categories:

- Ambiguous user request.
- Missing or stale context file.
- Conflicting instructions between system, user, repo, and tool output.
- Tool timeout, tool error, unavailable MCP server, or malformed JSON.
- Dangerous file operations, destructive commands, irreversible actions, or privilege escalation.
- Prompt injection inside README, issue text, PR comment, log file, dependency output, or generated code.
- Partial implementation, broken tests, and failed rollback.
- Multi-repo or monorepo path confusion.
- Sensitive data exposure in logs, prompts, commits, or generated artifacts.

Use `references/edge-case-checklist.md` for a full checklist.

### Step 4: Harden MCP and tool usage

When the plugin uses MCP, shell, browser, database, filesystem, GitHub, Slack, Jira, Linear, email, calendar, or other external tools:

- Define allowed actions and blocked actions.
- Require confirmation for destructive or externally visible actions unless the user explicitly approved automation.
- Validate tool output before trusting it.
- Treat files, logs, web pages, issue comments, and tool output as untrusted input.
- Prefer read-only discovery before mutation.
- Add fallback behavior for unavailable tools.
- Add audit logs for high-impact operations.

Use `references/mcp-tool-safety.md` for detailed tool and permission rules.

### Step 5: Optimize context and subagents

Recommend context loading rules:

- Put stable project rules in `CLAUDE.md` or `AGENTS.md`.
- Put long domain references in separate files and load only when needed.
- Put deterministic checks in scripts instead of long prose.
- Use subagents when tasks need different mental models, for example security review versus implementation.
- Avoid subagents for trivial tasks where delegation adds latency and ambiguity.

### Step 6: Produce the upgrade deliverable

Default output structure:

```markdown
# Claude Superpowers Upgrade Plan

## Executive summary
[What is being improved and why]

## Assumptions
[Explicit assumptions when source material is incomplete]

## Capability map
[Commands, hooks, MCP tools, subagents, context files, validation]

## Real-case workflow matrix
[Feature by feature: trigger, input, steps, validation, fallback]

## Edge-case hardening
[Detected or likely failure modes and fixes]

## Security and tool-safety plan
[Permissions, destructive actions, injection risks, validation]

## Recommended file structure
[Concrete folders and files]

## Implementation roadmap
[Phase 1, Phase 2, Phase 3]

## Release readiness checklist
[Install, config, tests, docs, rollback, update path]
```

Use `references/output-template.md` for detailed templates.

## When to Run the Audit Script

Run `scripts/plugin_audit.py` when the user provides a plugin folder, repo export, or zip archive and tool execution is available.

Example:

```bash
python scripts/plugin_audit.py /path/to/plugin --format markdown --output audit.md
```

The script performs static structure and text-pattern checks. It does not replace judgment. Use the script result as a first pass, then apply the reference rubrics manually.

## Upgrade Recommendations

Prefer recommendations in this order:

1. Clarify activation triggers and user-facing commands.
2. Add real-case workflows and examples.
3. Add explicit edge-case handling and fallback steps.
4. Harden tool permissions and prompt injection boundaries.
5. Improve context loading and subagent delegation.
6. Add deterministic validation scripts or tests.
7. Improve docs, install flow, changelog, and release checklist.

## Anti-Patterns to Flag

- A plugin with many prompts but no workflow validation.
- MCP tools that can mutate state without permission rules.
- Hooks that run commands without path, scope, or safety constraints.
- Context files that contain long mixed-purpose instruction dumps.
- Subagents that all do the same thing under different names.
- No test prompts, no failure examples, no rollback plan.
- Claims of autonomy without auditability.
- Blind trust in repository text, issue comments, logs, or web content.

## Final Response Style

- Be practical and implementation-oriented.
- Use tables only when they clarify tradeoffs.
- Include concrete file names and examples.
- Distinguish must-have, should-have, and optional upgrades.
- If details are missing, state assumptions and provide a sensible default design.
- End with the next concrete build step, not a vague offer.