Install
Before you start:
In your project folder:
curl -fsSL https://raw.githubusercontent.com/EricTechPro/super-board/main/get.sh | bash
Or as a Claude Code plugin:
/plugin marketplace add EricTechPro/super-board
/plugin install super-board@super-board
[!NOTE]
The plugin ships the skills only. Run /super-board:super-board onboard and its 🔍 Checks step adds the guard hooks, scripts and workflows. Needs Claude Code, gh, jq, bash 3.2+ and Python 3.9+; the installer checks.
Security
Two security skills come with every install, and they stay separate:
| Skill | Runs | Covers |
|---|
pr-security-review | On every PR, inside the QA lane. Each finding fails QA and goes back to Build. | The PR's diff against its base: high-confidence, exploitable bugs only. From Anthropic's claude-code-security-review. |
security-audit | Only when you ask (/security-audit). The board never runs it. | The whole repository, in depth. From Cloudflare's security-audit-skill, fetched at install with npx skills. |
--no-helper-skills skips the security-audit download; /super-board onboard adds it later.
Claude Code's built-in /security-review is left as it is.
Running from Codex or OpenCode? See supported hosts for tested versions, sign-in and gaps.
Optional post-run learning can delegate an already installed calibrate skill after
verified selected work completes. It applies only to explicitly permitted existing
canonical skill files; the package bundles no private skill. See
post-run calibration.
Quick start
1. Install
curl -fsSL https://raw.githubusercontent.com/EricTechPro/super-board/main/get.sh | bash
2. Onboard
/super-board onboard
Checks · GitHub · Board · Branch · AGENTS.md · Policies · Bug sources · Review. Enter takes the recommended answer.
3. Run
/super-board run my-app
Add cards to Ready. The board drains on its own.
How it works
Which path? Clear idea, foggy idea or bugs: the routing rule says what to run, and when 1–5 tickets go to /implement-spec instead of the board.
Skills
9 skills (5 you type, 4 the board runs). Uses Matt Pocock skills, ponytail, impeccable, humanizer, Anthropic's security review and Cloudflare's security-audit.
You type — 5 skills
| Skill | What it does |
|---|
/super-board | Orchestrator: plans waves, runs Build → QA → Review, merges when green. |
/super-collect | Finds problems, verifies them, writes a findings doc for /to-spec and /to-tickets. |
/ui-refine-loop | Critique → refine loop that polishes one page or component. |
/visual | One HTML page: branch recap, plan, or codebase map with diagrams. |
/git-sync | Commit per logical change, merge-pull, push without force, report. |
The board runs — 4 skills
| Skill | What it does |
|---|
/super-build | Builder lane: worktree, smallest safe change, tests, draft PR. |
/super-qa | Tester lane: evidence, test-gap check, screenshots, or bounce to Build. |
/super-review | Reviewer lane: own hypotheses, remembers prior findings, merge gate. |
/pr-security-review | Security pass on every PR diff; super-qa runs it, findings fail QA. |
Each name links to that skill's README. Adding a skill? Write its SKILL.md and README.md, add a line to skills/families.json, and this table updates itself.
Commands
/super-board onboard # 8-step setup, resumes
/super-board lint # vague ACs?
/super-board status # read-only snapshot
/super-board run <slug> # drain the board
/super-board stop # stop workers
/super-collect [source] # find problems → findings doc → /to-spec
/ui-refine-loop <route> # polish one page
/visual [recap|plan|path] # one HTML page
/git-sync # commit, pull, push
Flags: run --low|--high · run --codex[=<model>] · super-collect --since 30d
Guards & hooks
Run automatically once installed. Python stdlib, JSON in, JSON out.
| |
|---|
| guard-worktree-path | Blocks git worktree add outside .claude/worktrees/ |
| guard-secrets | Blocks reading or piping dotenv files, SSH keys and credential files; key names via super-board-env-check.sh |
| guard-key-literals | Blocks a live-looking API key written into a file; flags one already there |
| guard-delete-outside | Blocks rm, find -delete and git clean aimed outside the project, ~ or / |
| guard-protected-push | Opt-in (onboard asks, or install.sh --protect-main): blocks direct and force pushes to main/master/base |
| README sync | Regenerates the skill table; pre-commit and PostToolUse hooks keep it fresh |
| cleanup-wt | Removes merged worktrees and branches after each merge and at session start, with a recovery file |
| merge gate | Merges only after the current base plus your non-empty project verify_commands pass (missing checks halt setup), pinned to the reviewed commit; applies merge_policy and runs allowed DB migrations |
Models
A cheap router grades each card easy, medium or hard first; the run flag picks the model for each grade. With --codex, every lane runs on Codex GPT models instead of Claude.
| Command | Router | Easy card | Medium card | Hard card |
|---|
/super-board run | Haiku 4.5 | Sonnet 5.5 | Opus 5.5 | session model |
/super-board run --low | Haiku 4.5 | Haiku 4.5 | Sonnet 5.5 | Opus 5.5 |
/super-board run --high | Sonnet 5.5 | Opus 5.5 | Opus 5.5 | Opus 5.5 |
/super-board run --codex | gpt-6-luna | gpt-6.1-sol | gpt-6.1-sol | gpt-6-astra |
/super-board run --codex --low | gpt-6-luna | gpt-6-luna | gpt-6.1-sol | gpt-6.1-sol |
/super-board run --codex --high | gpt-6-luna | gpt-6-astra | gpt-6-astra | gpt-6-astra |
/super-board run --codex=<model> pins one model for every card and skips the router.
Run inside Codex? plain /super-board run switches to the Codex ladder by itself. Codex has no
/super-board command: it finds skills in .agents/skills/ (symlinks followed), so link
.claude/skills/super-board there and type $super-board run.
Writing standard
Commits, tickets, PR bodies and comments all follow one writing standard, in the pack and in every project it is installed into.
- Re-run the install line.
- Run
/super-board onboard; step 1 upgrades for you and keeps a backup.
- Try
board-migrate --dry-run on a copy of your board first.
Full notes
Credits
MIT © Eric Tech (LICENSE). Built on obra/superpowers, mattpocock/skills, BuilderIO/skills and tt-a1i/archify. pr-security-review is ported from anthropics/claude-code-security-review (MIT © 2025 Anthropic, notice); security-audit is cloudflare/security-audit-skill (MIT © 2025-2026 Cloudflare, Inc.), installed from its own repo, not bundled.
Worker skill availability
Setup and dispatch resolve real, nonempty SKILL.md files for the actual
Claude or Codex host. Missing required skills halt before claims or workers;
lockfiles and arbitrary plugin caches do not count. The shared registry in
scripts/super-board-skills-ready.py owns lane dependencies, overrides and the
two declared ponytail fallbacks. The QA lane requires the bundled
pr-security-review; Cloudflare's security-audit is an optional QA entry,
so a missing copy never halts a run. Setup's full helper union may be red while a
selected card is runnable. Read-only checks never install; explicit onboard
repair rechecks files after installation.
The CLI accepts --home <fixture-home> and --catalog <active-skills.json>.
Launchers accept the same inventory through SUPER_BOARD_SKILLS_HOME and
SUPER_BOARD_SKILLS_CATALOG; neither changes the actual host. Catalog shape:
{"host":"codex","skills":[{"name":"vendor:skill","path":"/exact/SKILL.md", "enabled":true,"scope":"project","project_root":"/exact/project"}]}.
User entries use scope:"user". Restart explicitly after repairing missing
skills; readiness certifies availability, not their content or external tools.
