Home · Development Workflow · writing-plans

writing-plans

The Superpowers planning skill: turns a spec into a bite-sized, TDD-shaped implementation plan — exact files, exact signatures, a failing test before every implementation step.

FreeMITClaude CodeCursorCodexDeep test
Sourceanthropics/skills
Repo stars303,565 (background only)
Skill filesSKILL.md
Size204 lines · ~2,584 tokens
Skill updated2026-09-25
Reviewed2026-10-23
CategoryDevelopment Workflow
Retest triggersMajor update · 90 days · report

Score

88/100
A

“The strongest workflow skill we have tested. Its plan is executable by a developer who has never seen the codebase — 26 checkbox steps, 14 tests written as code, exact signatures in every task — where a competent baseline outline still leaves every interface to be invented. Docked for a description with no off-switch and a plan header that hard-wires Superpowers' own execution skills.”

Live test results27/30

The clearest A/B gap we have measured: the with-skill plan can be handed to a stranger, the baseline cannot — it still leaves every interface to be invented at the keyboard.

Sub-scores & evidence
Task completionEvery element of the brief maps to a task: registration and login, server-side sessions in SQLite, the unused users table (pinned schema plus a drop-and-recreate decision for when it differs), cookie flags, and an auth-aware nav.12/12
Beats the no-skill baselineCountable gaps: 26 checkbox steps vs 0; 14 tests written as code with assertions vs 6 prose bullets; 11 run commands with expected output vs one closing 'run pytest'; exact signatures in 5 Interfaces blocks vs a list of function names. Not higher because the baseline names the same libraries, flags and failure concerns — in prose.8/10
Self-verification in outputThe plan carries the skill's self-review on its face: a Review Focus section lists five uncovered failure modes, each pinned to a named test in the task that owns the code, and spec coverage can be audited task by task.5/5
Failure behaviourNo failure case was injected into the brief itself; the credit here is that the five likeliest failure modes (duplicate email, credential enumeration, expired token, forged cookie, empty fields) are designed into the plan's tests instead of discovered after shipping.2/3
Workflow design19/20

A complete procedure with a hard human gate at the end: nothing gets implemented until the plan is reviewed and an execution method is chosen.

Sub-scores & evidence
Clear stepsPlan header, file-structure mapping, task right-sizing, then steps of exactly one action each — the five canonical step types (failing test, run, implement, run, commit) are named with examples.6/6
Inputs & outputs definedEvery task in its template carries Files (Create/Modify/Test with exact paths) and Interfaces (Consumes/Produces with exact signatures), plus a header pinning Goal, Architecture, Tech Stack, Spec and Global Constraints.4/4
Checks & verificationA five-point self-review the author runs before handoff: spec coverage, step scan, type consistency, review focus, proportion — plus an expected output on every verification step.4/4
Stop conditionsThe execution handoff is an explicit stop: link the plan, wait for the human's review, let them choose subagent-driven or native execution. The wording to use is supplied verbatim.3/3
Failure recoveryThe self-review loop fixes gaps inline and adds missing tasks; the proportion check catches plans that have degenerated into code transcripts. Nothing covers a plan failing mid-execution — that is delegated to a sibling skill.2/3
Structure & context cost13/15

One 204-line file, tightened by its own last release. No reference files — its only layering is by reference, handing execution off to sibling skills.

Sub-scores & evidence
LeannessSKILL.md is 204 lines / 10,335 bytes — about 2,584 tokens in the always-loaded layer, well under the 500-line guideline.5/5
Progressive disclosureEverything sits in the one file. Execution detail is not layered into references; instead the plan header orders the executor to load superpowers:subagent-driven-development or superpowers:executing-plans.3/5
Organisation & namingOverview, scope check, file structure, task sizing, granularity, header template, task template, step contents, self-review, handoff — in the order a planner works through them.3/3
No paddingThe last commit touching this file (v6.4.2, 2026-09-25) was a tightening pass titled 'leaner plans'; the text defines a step by what it must not contain.2/2
Trigger quality11/15

A clean 'use when' with a timing condition — and no off-switch anywhere in the description.

Sub-scores & evidence
What it doesName plus description leave no ambiguity: implementation plans, written from a spec or requirements.4/4
When to use'Use when you have a spec or requirements for a multi-step task, before touching code' — an explicit trigger with a timing condition most skills omit.4/4
User-word keywords'Spec', 'requirements' and 'multi-step task' are phrases users actually type. 'Plan', 'implementation plan' and 'design doc' never appear — a bare 'write me a plan' request leans on the skill name to match.2/3
When NOT to useNo boundary statement at all. Nothing says 'skip me for a one-file fix'; the body's Scope Check pushes back on oversized specs, but the description gives a small task no protection from the full ceremony.0/3
Naming & voiceFunctional two-word name; description written as an instruction to the agent.1/1
Safety score9/10

A single Markdown file that asks for nothing: no tools, no network, no file access beyond the plan it writes. Its riskiest content is a sample git commit inside a template.

Sub-scores & evidence
Least privilegePattern scan of the full text found no URLs, no credential, token or password strings, no shell commands to run at load time; the only non-ASCII characters are em-dashes (zero zero-width characters).4/4
Declared tool scopeFrontmatter is name and description only — no allowed-tools field declares the (empty) tool scope.2/3
Sensitive-action confirmationThe workflow ends in a confirmation gate: the plan must be reviewed by the human and an execution method chosen before any code is written. The git commits inside a plan's tasks happen after that gate, task by task.3/3
Content & engineering9/10

Two complete templates and a definition of a good step you can test mechanically: can the implementer write exactly one reasonable thing from it?

Sub-scores & evidence
Examples & templatesA full plan-header template and a full task skeleton, including sample test code, run commands with expected output, and the commit block.3/3
Scripts & instruction precisionShips no scripts — the precision lives in the templates and in rules like 'a plan longer than the code it describes has written the code instead'.2/3
Dependencies statedZero dependencies for the skill itself. Its handoff depends on two named sibling skills, and the text names them at the exact step where they are needed.2/2
Concrete instructionsExact save-path pattern (docs/superpowers/plans/YYYY-MM-DD-<feature-name>.md), verbatim handoff wording, and named plan failures: 'TBD', 'handle edge cases', 'write tests for the above'.2/2

Best for / not for

Best for

  • Handing a feature to another developer or a fresh agent session without a knowledge-transfer meeting
  • Multi-step features where interface names must stay consistent across tasks written days apart
  • Spec-driven teams who want TDD and a commit per task as the default, not a hope

Not for

  • One-file fixes and small changes — the full ceremony costs more than the work
  • Anyone outside the Superpowers plugin: the plan header orders executors to use its sibling skills
  • Vague ideas with no spec yet — this skill consumes requirements, it does not create them

What it does

writing-plans is one 204-line file that prescribes a plan the way other skills prescribe code. Every plan must open with a fixed header (goal, architecture, tech stack, the spec it implements), a Global Constraints section carrying the spec’s exact values, and a Review Focus section: the five input classes or failure modes the spec implies but no task’s tests exercise, written down once, each with a test pinned to the task that owns the code.

Below the header, work is decomposed into tasks sized to “the smallest unit that carries its own test cycle and is worth a fresh reviewer’s gate”. Each task states its files, and — the detail that does the most work — an Interfaces block: what the task consumes from earlier tasks and what it produces, with exact function names, parameter and return types, because “a task’s implementer sees only their own task”. Steps are checkboxed, one action each, cycling write-the-failing-test, run it, implement, run it, commit. The skill is equally specific about what a step may not contain: “Lines that decide nothing (‘TBD’, ‘handle edge cases’, ‘add appropriate validation’, ‘write tests for the above’) are the opposite failure” of a plan that transcribes the whole program.

It closes with a five-point self-review (spec coverage, step scan, type consistency, review focus, proportion) and a hard stop: the plan is linked for the human to read, and implementation waits until they have reviewed it and chosen how to execute.

How the live test went

We ran one brief twice — plan an email/password login with server-side sessions for a small Flask app whose users table exists but is unused, for handover to a developer who has never seen the code. Both plans are published in full with this review.

The baseline is genuinely good. In 90 lines it covers the database work, names werkzeug for hashing, lists the cookie flags, insists on generic login errors, and puts tests and security in their own sections. Most teams would accept it. But read it as the receiving developer: the model functions are named, never signed — every interface gets invented at the keyboard, by whoever writes that task, possibly inconsistently across tasks. Testing is one closing section. There is exactly one commit instruction, in the final sentence.

The with-skill plan is 324 lines and leaves the receiving developer almost nothing to invent. The unused users table gets a pinned schema and a stated decision — drop and recreate it if it differs, because it holds no data. Session expiry is a number (604800 seconds) used identically in the database and the cookie. The identical-failure requirement is not a principle in a checklist; it is a test asserting unknown.data == wrong.data. Fourteen tests exist as code, eleven steps give a command and the output that means it worked, and each of the five tasks ends in its own commit. The Review Focus section earns its place: of its five failure modes, two (expired-token cleanup, forged-cookie handling) are things the baseline plan mentions nowhere.

Where it falls short

Start with the trigger: the description has no when-not boundary, so the only thing standing between a two-line fix and a five-section planning ceremony is the phrase “multi-step task”. Second, ecosystem lock-in is baked into the output itself — every plan’s header instructs the executor to use superpowers:subagent-driven-development or superpowers:executing-plans, which is dead weight (or an unmet dependency) outside the Superpowers plugin. Third, thin inputs expose a seam: Global Constraints demands values “copied verbatim from the spec”, but our brief was one paragraph, so the plan pinned values the spec never contained — 604800 seconds, the session_id cookie name — without marking which values came from the spec and which the planner chose. The decisions are good ones. A reader still cannot tell them apart from requirements. Finally, our with-skill run added a task the brief never asked for (protecting item creation) — hedged with an explicit fallback, but the skill’s Scope Check only guards against specs that are too big, not plans that quietly grow.

Live A/B test — the evidence

One brief, run twice: write an implementation plan for adding email/password login with server-side sessions to an existing small Flask app (app.py with routes /, /items, /items/<id>; models.py using SQLite via sqlite3 with a users table that exists but is unused; Jinja2 templates; 3 existing pytest tests). The plan will be handed to a developer who has never seen the codebase.

With the skill

Approach: The skill followed literally: mandated plan header with Global Constraints and Review Focus, file-structure map first, then five tasks — each with Files, Interfaces (exact signatures), and checkbox steps cycling failing test → run → implement → run → commit

  • 26 checkbox steps; 14 tests written as actual code with exact assertions and expected outputs
  • Every decision the brief left open is pinned: users-table schema, session TTL of 604800s, cookie name and flags, a byte-identical 401 for unknown email vs wrong password
  • Review Focus section names five failure modes, each pinned to a named test in the task that owns the code

Without the skill (baseline)

Approach: A conventional plan written from scratch: overview, then sections for database, passwords, routes, templates, cookie, tests and a security checklist

  • Covers the same ground in prose — werkzeug hashing, HttpOnly/SameSite/Secure flags, generic login errors, duplicate-email rejection
  • Functions listed by name only; no signatures, so the executing developer invents every interface
  • All testing compressed into one closing section of six bullets, with a single 'run pytest' and one sentence about committing
Objective countWith skillBaseline
Plan length324 lines90 lines
Checkbox steps (one action each)260
Tests written as code with assertions140 (6 prose bullets)
Run commands with expected output110
Tasks with exact files + interface signatures5/50/5
Commit steps50 (one closing sentence)

The baseline is a good outline and would satisfy most teams. It is not executable as written: names, signatures, test contents and order of verification all remain to be decided by whoever picks it up. The with-skill plan removes those decisions — that removal, counted above, is the entire difference.

Full outputs: With-skill plan (full output) · Without-skill plan (baseline)

Trigger tests

PromptExpectedResult
“I have a spec for adding OAuth login — write the implementation plan before we start coding”triggerTriggers — spec, multi-step task, and 'before touching code' all match the description verbatim.
“Here are the requirements for the new billing module — break it into tasks for a developer”triggerTriggers — 'requirements for a multi-step task' is the description's own framing.
“Write a plan for migrating our blog from WordPress to Hugo”triggerBorderline trigger — no formal spec exists, but a prose brief is requirements for a multi-step task; the body's Scope Check would push back if the migration spanned independent subsystems.
“Plan my 5-day trip to Kyoto”skipSkips — no spec or requirements and no code to touch; the description's conditions are software-shaped even though it never says the word software.
“Fix this failing test in models.py”skipSkips — a single-step fix with no spec. Nothing in the description claims it, though the missing when-not boundary means a chattier request could still pull the skill in.

Desk-simulated against the skill's description matching rules; noted as simulated wherever the score depends on it.

Security screen

✓ Pass
Credential theft / exfiltration

✓ Pass
Remote code download & execute

✓ Pass
Data sent to unrelated third parties

✓ Pass
Hidden instructions (incl. invisible Unicode)

✓ Pass
Obfuscated payloads

✓ Pass
Privilege escalation requests

Screening only — not a security certification. This skill is a single Markdown file with no scripts; we scanned the full text for network, shell and credential patterns and for invisible characters. Industry context: Snyk's ToxicSkills scan of 3,984 public skills found security flaws in 36.82% of them.

Install

Claude Code (official marketplace)

/plugin install superpowers@claude-plugins-official

Claude Code (Superpowers marketplace)

/plugin marketplace add obra/superpowers-marketplace
/plugin install superpowers@superpowers-marketplace

Any agent (skills CLI)

npx skills add obra/superpowers --skill writing-plans

Cursor / Codex (manual)

# copy the writing-plans folder from the repo's skills/ directory into:
.cursor/skills/writing-plans/   # Cursor project
.agents/skills/writing-plans/   # shared agents folder

Alternatives

brainstorming (obra/superpowers)

The upstream sibling in the same plugin: it produces the spec that writing-plans consumes. If your starting point is an idea rather than requirements, brainstorming is the entry point and writing-plans is step two.

GitHub Spec Kit

The external alternative: a CLI workflow (specify → plan → tasks) that generates the same family of documents outside any agent plugin. Heavier to set up, but the documents are tool-neutral in a way Superpowers' header — which names its own execution skills — is not.

Frequently asked questions

Is the writing-plans skill safe?

In our screening on 2026-10-23, writing-plans passed all six security red lines (credential theft, remote code execution, data exfiltration, hidden instructions, obfuscated payloads, privilege abuse) and scored 9/10 on the safety dimension. Screening is not a certification — re-screen after major updates.

What is the writing-plans skill used for?

The Superpowers planning skill: turns a spec into a bite-sized, TDD-shaped implementation plan — exact files, exact signatures, a failing test before every implementation step.

How do I install the writing-plans skill?

For Claude Code, add the marketplace and install the plugin set that contains it. With the skills CLI: npx skills add anthropics/skills --skill writing-plans. For Cursor or Codex, copy the writing-plans folder into .cursor/skills/ or .agents/skills/. Full commands are in the Install section of this page.

How good is the writing-plans skill?

writing-plans scored 88/100 (grade A) in our live test on 2026-10-23: The strongest workflow skill we have tested. Its plan is executable by a developer who has never seen the codebase — 26 checkbox steps, 14 tests written as code, exact signatures in every task — where a competent baseline outline still leaves every interface to be invented. Docked for a description with no off-switch and a plan header that hard-wires Superpowers' own execution skills.

Tested 2026-10-23 in an agent environment following the skill's own instructions — not inside the Cursor desktop app. Scores follow the Skills List methodology v1: red lines veto regardless of score; install counts and stars never count toward quality. More in Development Workflow.