Is brainstorming safe?
obra/superpowers · scanned Oct 4, 2026
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
Some patterns deserve a look before you install.
- Repository
- obra/superpowers/skills/brainstorming
- Commit
- 8ca22dba9a94
- Scanned
- Oct 4, 2026
- Files checked
- 8
- Stars
- 295k
- License
- MIT
- Last push
- Sep 27, 2026
Reads variables named like API keys, tokens or passwords, or dumps the whole environment. Check where the values go.
skills/brainstorming/scripts/server.cjs:123
const TOKEN_FILE = process.env.BRAINSTORM_TOKEN_FILE || null;
Reads variables named like API keys, tokens or passwords, or dumps the whole environment. Check where the values go.
skills/brainstorming/scripts/server.cjs:133
if (process.env.BRAINSTORM_TOKEN) {Reads variables named like API keys, tokens or passwords, or dumps the whole environment. Check where the values go.
skills/brainstorming/scripts/server.cjs:134
return { value: process.env.BRAINSTORM_TOKEN, source: 'env' };Many legitimate skills run commands. Check that the commands match what the skill says it does.
skills/brainstorming/scripts/server.cjs:537
const cp = require('child_process');Files scanned (8)
- skills/brainstorming/scripts/frame-template.html (7.9 KB)
- skills/brainstorming/scripts/helper.js (5.5 KB)
- skills/brainstorming/scripts/server.cjs (25.1 KB)
- skills/brainstorming/scripts/start-server.sh (6.7 KB)
- skills/brainstorming/scripts/stop-server.sh (3.2 KB)
- skills/brainstorming/SKILL.md (17.1 KB)
- skills/brainstorming/spec-document-reviewer-prompt.md (1.7 KB)
- skills/brainstorming/visual-companion.md (13.1 KB)
[](https://skillsvetted.com/skills/obra/brainstorming)
A full review covers what pattern matching can't: intent, logic and behavior in a sandbox.