Super Board Agent Skill

<div align="center"> <img src="docs/assets/logo.svg" width="88" height="88" alt="super-board kanban logo"> <h1>super-board</h1> <p><strong>Add tasks, walk away, get merged PRs with proof.</strong></p> <p>Stop babysitting coding agents: cards you drop in Ready come back as tested, reviewed PRs.</p> <p>9 skills (5 you type, 4 the board runs) · 9 commands · 6 guard hooks</p> <p> <img alt="Version" src="https://img.shields.io/badge/version-3.3.0-1f883d?style=flat-square"> <img alt="Host" src="https://img.shields.io/badge/Claude%20Code-skills-d97757?style=flat-square"> <img alt="License" src="https://img.shields.io/badge/license-MIT-0969da?style=flat-square"> </p> <p><a href="https://erictechpro.github.io/super-board/"><strong>🌐 Live site: erictechpro.github.io/super-board</strong></a></p> <p>⭐ Star this repo if it helps · <a href="https://www.skool.com/erictech">Join the builders using this → weekly live calls, setup help</a> · <a href="https://youtu.be/aggJvNZxfKA">▶ Watch the walkthrough</a></p> <p><a href="#install">Install</a> · <a href="#quick-start">Quick start</a> · <a href="#how-it-works">How it works</a> · <a href="#skills">Skills</a> · <a href="#commands">Commands</a> · <a href="#guards--hooks">Guards</a></p> </div> <p align="center"><a href="https://erictechpro.github.io/super-board/skill-map/"><img src="docs/assets/skill-map.png" alt="The super-board skill map: open the interactive version" width="100%"></a></p> <p align="center">_{The skill map. Click it for the live version: zoom, pan, open any node.}</p>

Install

Before you start:

• Claude Code, and gh with board access: gh auth refresh -s project,read:project,repo
• Dynamic workflows on in /config (backends)
• verify_commands set in your config, so the merge gate can prove the build (setup notes)

In your project folder:

curl -fsSL https://raw.githubusercontent.com/EricTechPro/super-board/main/get.sh | bash

Or as a Claude Code plugin:

/plugin marketplace add EricTechPro/super-board
/plugin install super-board@super-board

[!NOTE] The plugin ships the skills only. Run /super-board:super-board onboard and its 🔍 Checks step adds the guard hooks, scripts and workflows. Needs Claude Code, gh, jq, bash 3.2+ and Python 3.9+; the installer checks.

Security

Two security skills come with every install, and they stay separate:

Skill	Runs	Covers
pr-security-review	On every PR, inside the QA lane. Each finding fails QA and goes back to Build.	The PR's diff against its base: high-confidence, exploitable bugs only. From Anthropic's claude-code-security-review.
security-audit	Only when you ask (/security-audit). The board never runs it.	The whole repository, in depth. From Cloudflare's security-audit-skill, fetched at install with npx skills.

--no-helper-skills skips the security-audit download; /super-board onboard adds it later. Claude Code's built-in /security-review is left as it is.

Running from Codex or OpenCode? See supported hosts for tested versions, sign-in and gaps.

Optional post-run learning can delegate an already installed calibrate skill after verified selected work completes. It applies only to explicitly permitted existing canonical skill files; the package bundles no private skill. See post-run calibration.

Quick start

1. Install

curl -fsSL https://raw.githubusercontent.com/EricTechPro/super-board/main/get.sh | bash

2. Onboard

/super-board onboard

Checks · GitHub · Board · Branch · AGENTS.md · Policies · Bug sources · Review. <kbd>Enter</kbd> takes the recommended answer.

3. Run

/super-board run my-app

Add cards to Ready. The board drains on its own.

How it works

Which path? Clear idea, foggy idea or bugs: the routing rule says what to run, and when 1–5 tickets go to /implement-spec instead of the board.

<p align="center"><a href="https://youtu.be/aggJvNZxfKA"><img src="https://i.ytimg.com/vi/aggJvNZxfKA/maxresdefault.jpg" alt="Watch I Built a Self-Improving Software Factory by Eric Tech on YouTube" width="100%"></a></p> <p align="center"><a href="https://youtu.be/aggJvNZxfKA"><strong>▶ Watch on YouTube: I Built a Self-Improving Software Factory</strong></a></p>

Skills

9 skills (5 you type, 4 the board runs). Uses Matt Pocock skills, ponytail, impeccable, humanizer, Anthropic's security review and Cloudflare's security-audit.

<!-- skills:start -->

You type — 5 skills

Skill	What it does
/super-board	Orchestrator: plans waves, runs Build → QA → Review, merges when green.
/super-collect	Finds problems, verifies them, writes a findings doc for /to-spec and /to-tickets.
/ui-refine-loop	Critique → refine loop that polishes one page or component.
/visual	One HTML page: branch recap, plan, or codebase map with diagrams.
/git-sync	Commit per logical change, merge-pull, push without force, report.

The board runs — 4 skills

Skill	What it does
/super-build	Builder lane: worktree, smallest safe change, tests, draft PR.
/super-qa	Tester lane: evidence, test-gap check, screenshots, or bounce to Build.
/super-review	Reviewer lane: own hypotheses, remembers prior findings, merge gate.
/pr-security-review	Security pass on every PR diff; super-qa runs it, findings fail QA.

<!-- skills:end -->

Each name links to that skill's README. Adding a skill? Write its SKILL.md and README.md, add a line to skills/families.json, and this table updates itself.

Commands

/super-board onboard          # 8-step setup, resumes
/super-board lint             # vague ACs?
/super-board status           # read-only snapshot
/super-board run <slug>       # drain the board
/super-board stop             # stop workers
/super-collect [source]       # find problems → findings doc → /to-spec
/ui-refine-loop <route>       # polish one page
/visual [recap|plan|path]     # one HTML page
/git-sync                     # commit, pull, push

Flags: run --low|--high · run --codex[=<model>] · super-collect --since 30d

Guards & hooks

Run automatically once installed. Python stdlib, JSON in, JSON out.

guard-worktree-path	Blocks git worktree add outside .claude/worktrees/
guard-secrets	Blocks reading or piping dotenv files, SSH keys and credential files; key names via super-board-env-check.sh
guard-key-literals	Blocks a live-looking API key written into a file; flags one already there
guard-delete-outside	Blocks rm, find -delete and git clean aimed outside the project, ~ or /
guard-protected-push	Opt-in (onboard asks, or install.sh --protect-main): blocks direct and force pushes to main/master/base
README sync	Regenerates the skill table; pre-commit and PostToolUse hooks keep it fresh
cleanup-wt	Removes merged worktrees and branches after each merge and at session start, with a recovery file
merge gate	Merges only after the current base plus your non-empty project verify_commands pass (missing checks halt setup), pinned to the reviewed commit; applies merge_policy and runs allowed DB migrations

Models

A cheap router grades each card easy, medium or hard first; the run flag picks the model for each grade. With --codex, every lane runs on Codex GPT models instead of Claude.

Command	Router	Easy card	Medium card	Hard card
/super-board run	Haiku 4.5	Sonnet 5.5	Opus 5.5	session model
/super-board run --low	Haiku 4.5	Haiku 4.5	Sonnet 5.5	Opus 5.5
/super-board run --high	Sonnet 5.5	Opus 5.5	Opus 5.5	Opus 5.5
/super-board run --codex	gpt-6-luna	gpt-6.1-sol	gpt-6.1-sol	gpt-6-astra
/super-board run --codex --low	gpt-6-luna	gpt-6-luna	gpt-6.1-sol	gpt-6.1-sol
/super-board run --codex --high	gpt-6-luna	gpt-6-astra	gpt-6-astra	gpt-6-astra

/super-board run --codex=<model> pins one model for every card and skips the router.

Run inside Codex? plain /super-board run switches to the Codex ladder by itself. Codex has no /super-board command: it finds skills in .agents/skills/ (symlinks followed), so link .claude/skills/super-board there and type $super-board run.

Writing standard

Commits, tickets, PR bodies and comments all follow one writing standard, in the pack and in every project it is installed into.

<details> <summary><strong>Upgrading from 2.x</strong></summary>

1. Re-run the install line.
2. Run /super-board onboard; step 1 upgrades for you and keeps a backup.
3. Try board-migrate --dry-run on a copy of your board first.

Full notes

</details>

Credits

MIT © Eric Tech (LICENSE). Built on obra/superpowers, mattpocock/skills, BuilderIO/skills and tt-a1i/archify. pr-security-review is ported from anthropics/claude-code-security-review (MIT © 2025 Anthropic, notice); security-audit is cloudflare/security-audit-skill (MIT © 2025-2026 Cloudflare, Inc.), installed from its own repo, not bundled.

---

<p align="center"> <a href="https://erictechpro.github.io/super-board/">Live site</a> · <a href="https://erictechpro.github.io/super-board/skill-map/">Skill map</a> · <a href="https://erictechpro.github.io/super-board/writing-standard/">Writing standard</a> · <a href="https://erictechpro.github.io/super-board/onboarding/">Setup simulator</a> · <a href="https://erictechpro.github.io/super-board/impeccable/">Impeccable map</a> · <a href="https://erictechpro.github.io/super-board/pstack/">pstack map</a> · <a href="https://erictechpro.github.io/super-board/security-audit/">Security audit map</a> · <a href="RELEASE-NOTES.md">Release notes</a> · <a href="RELEASING.md">Release checks</a> · <a href="https://youtu.be/nX_bGyIOFM4">YouTube walkthrough</a> </p> <p align="center">_{Made by Eric Tech}</p>

Worker skill availability

Setup and dispatch resolve real, nonempty SKILL.md files for the actual Claude or Codex host. Missing required skills halt before claims or workers; lockfiles and arbitrary plugin caches do not count. The shared registry in scripts/super-board-skills-ready.py owns lane dependencies, overrides and the two declared ponytail fallbacks. The QA lane requires the bundled pr-security-review; Cloudflare's security-audit is an optional QA entry, so a missing copy never halts a run. Setup's full helper union may be red while a selected card is runnable. Read-only checks never install; explicit onboard repair rechecks files after installation.

The CLI accepts --home <fixture-home> and --catalog <active-skills.json>. Launchers accept the same inventory through SUPER_BOARD_SKILLS_HOME and SUPER_BOARD_SKILLS_CATALOG; neither changes the actual host. Catalog shape: {"host":"codex","skills":[{"name":"vendor:skill","path":"/exact/SKILL.md", "enabled":true,"scope":"project","project_root":"/exact/project"}]}. User entries use scope:"user". Restart explicitly after repairing missing skills; readiness certifies availability, not their content or external tools.