Maintainer of this skill?
Automated security scan — not a certification.
by EricTechPro
Autonomous GitHub Project build → QA → review loop for Claude Code. One-line install.
# Add to your Claude Code skills
git clone https://github.com/EricTechPro/super-boardGuides for using ai agents skills like super-board.
Last scanned: 11/6/2026
{
"issues": [
{
"file": "README.md",
"line": 41,
"type": "remote-install",
"message": "Install command (remote install script piped to a shell — review the source before running): \"curl -fsSL https://raw.githubusercontent.com/EricTechPro/super-board/main/get.sh\"",
"severity": "low"
},
{
"file": "skills/super-build/SKILL.md",
"line": 120,
"type": "dangerous-command",
"message": "Dangerous command (disables permission prompts): \"--dangerously-skip-permissions\"",
"severity": "medium"
},
{
"file": "skills/super-qa/SKILL.md",
"line": 23,
"type": "secret-exfiltration",
"message": "Instruction appears to send credentials/secrets to an external endpoint",
"severity": "medium"
},
{
"file": "skills/super-qa/SKILL.md",
"line": 29,
"type": "secret-exfiltration",
"message": "Instruction appears to send credentials/secrets to an external endpoint",
"severity": "medium"
}
],
"status": "PASSED",
"scannedAt": "2026-11-06T11:50:56.800Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}See how super-board compares with popular alternatives.
super-board is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by EricTechPro. Autonomous GitHub Project build → QA → review loop for Claude Code. One-line install. It has 614 GitHub stars.
Yes. super-board passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/EricTechPro/super-board" and add it to your Claude Code skills directory (see the Installation section above).
super-board is primarily written in HTML. It is open-source under EricTechPro on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh super-board against similar tools.
No comments yet. Be the first to share your thoughts!
From $49 · 30 days · terms & refunds
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Automated security scan — not a certification.
Before you start:
gh with board access: gh auth refresh -s project,read:project,repo/config (backends)verify_commands set in your config, so the merge gate can prove the build (setup notes)In your project folder:
curl -fsSL https://raw.githubusercontent.com/EricTechPro/super-board/main/get.sh | bash
Or as a Claude Code plugin:
/plugin marketplace add EricTechPro/super-board
/plugin install super-board@super-board
[!NOTE] The plugin ships the skills only. Run
/super-board:super-board onboardand its 🔍 Checks step adds the guard hooks, scripts and workflows. Needs Claude Code,gh,jq, bash 3.2+ and Python 3.9+; the installer checks.
Two security skills come with every install, and they stay separate:
| Skill | Runs | Covers |
|---|---|---|
pr-security-review |
On every PR, inside the QA lane. Each finding fails QA and goes back to Build. | The PR's diff against its base: high-confidence, exploitable bugs only. From Anthropic's claude-code-security-review. |
security-audit |
Only when you ask (/security-audit). The board never runs it. |
The whole repository, in depth. From Cloudflare's security-audit-skill, fetched at install with npx skills. |
--no-helper-skills skips the security-audit download; /super-board onboard adds it later.
Claude Code's built-in /security-review is left as it is.
Running from Codex or OpenCode? See supported hosts for tested versions, sign-in and gaps.
Optional post-run learning can delegate an already installed calibrate skill after
verified selected work completes. It applies only to explicitly permitted existing
canonical skill files; the package bundles no private skill. See
post-run calibration.
curl -fsSL https://raw.githubusercontent.com/EricTechPro/super-board/main/get.sh | bash
/super-board onboard
Checks · GitHub · Board · Branch · AGENTS.md · Policies · Bug sources · Review. Enter takes the recommended answer.
/super-board run my-app
Add cards to Ready. The board drains on its own.
Which path? Clear idea, foggy idea or bugs: the routing rule says what to run, and when 1–5 tickets go to /implement-spec instead of the board.
9 skills (5 you type, 4 the board runs). Uses Matt Pocock skills, ponytail, impeccable, humanizer, Anthropic's security review and Cloudflare's security-audit.
You type — 5 skills
| Skill | What it does |
|---|---|
/super-board |
Orchestrator: plans waves, runs Build → QA → Review, merges when green. |
/super-collect |
Finds problems, verifies them, writes a findings doc for /to-spec and /to-tickets. |
/ui-refine-loop |
Critique → refine loop that polishes one page or component. |
/visual |
One HTML page: branch recap, plan, or codebase map with diagrams. |
/git-sync |
Commit per logical change, merge-pull, push without force, report. |
The board runs — 4 skills
| Skill | What it does |
|---|---|
/super-build |
Builder lane: worktree, smallest safe change, tests, draft PR. |
/super-qa |
Tester lane: evidence, test-gap check, screenshots, or bounce to Build. |
/super-review |
Reviewer lane: own hypotheses, remembers prior findings, merge gate. |
/pr-security-review |
Security pass on every PR diff; super-qa runs it, findings fail QA. |
Each name links to that skill's README. Adding a skill? Write its SKILL.md and README.md, add a line to skills/families.json, and this table updates itself.
/super-board onboard # 8-step setup, resumes
/super-board lint # vague ACs?
/super-board status # read-only snapshot
/super-board run <slug> # drain the board
/super-board stop # stop workers
/super-collect [source] # find problems → findings doc → /to-spec
/ui-refine-loop <route> # polish one page
/visual [recap|plan|path] # one HTML page
/git-sync # commit, pull, push
Flags: run --low|--high · run --codex[=<model>] · super-collect --since 30d
Run automatically once installed. Python stdlib, JSON in, JSON out.
| guard-worktree-path | Blocks git worktree add outside .claude/worktrees/ |
| guard-secrets | Blocks reading or piping dotenv files, SSH keys and credential files; key names via super-board-env-check.sh |
| guard-key-literals | Blocks a live-looking API key written into a file; flags one already there |
| guard-delete-outside | Blocks rm, find -delete and git clean aimed outside the project, ~ or / |
| guard-protected-push | Opt-in (onboard asks, or install.sh --protect-main): blocks direct and force pushes to main/master/base |
| README sync | Regenerates the skill table; pre-commit and PostToolUse hooks keep it fresh |
| cleanup-wt | Removes merged worktrees and branches after each merge and at session start, with a recovery file |
| merge gate | Merges only after the current base plus your non-empty project verify_commands pass (missing checks halt setup), pinned to the reviewed commit; applies merge_policy and runs allowed DB migrations |
A cheap router grades each card easy, medium or hard first; the run flag picks the model for each grade. With --codex, every lane runs on Codex GPT models instead of Claude.
| Command | Router | Easy card | Medium card | Hard card |
|---|---|---|---|---|
/super-board run |
Haiku 4.5 | Sonnet 5.5 | Opus 5.5 | session model |
/super-board run --low |
Haiku 4.5 | Haiku 4.5 | Sonnet 5.5 | Opus 5.5 |
/super-board run --high |
Sonnet 5.5 | Opus 5.5 | Opus 5.5 | Opus 5.5 |
/super-board run --codex |
gpt-6-luna | gpt-6.1-sol | gpt-6.1-sol | gpt-6-astra |
/super-board run --codex --low |
gpt-6-luna | gpt-6-luna | gpt-6.1-sol | gpt-6.1-sol |
/super-board run --codex --high |
gpt-6-luna | gpt-6-astra | gpt-6-astra | gpt-6-astra |
/super-board run --codex=<model> pins one model for every card and skips the router.
Run inside Codex? plain /super-board run switches to the Codex ladder by itself. Codex has no
/super-board command: it finds skills in .agents/skills/ (symlinks followed), so link
.claude/skills/super-board there and type $super-board run.
Commits, tickets, PR bodies and comments all follow one writing standard, in the pack and in every project it is installed into.
/super-board onboard; step 1 upgrades for you and keeps a backup.board-migrate --dry-run on a copy of your board first.MIT © Eric Tech (LICENSE