Superpowers / skills/brainstorming/SKILL.md
Brainstorming
A requirements conversation with explicit scope choices, a design review and an optional local visual companion.
Runtime probed · reviewed · A helper or bounded runtime behavior was probed. This does not establish model task effectiveness or comprehensive security.
01 / Task fit
Where it may help.
These are intended uses indicated by the upstream material. They are not measured outcomes.
- Clarifying a substantial feature or design request
- Discussing layout alternatives through an optional local preview
What it is
Brainstorming helps an agent work out what a person wants before building a substantial change. It distinguishes a clear small request from a project that needs a written design. Its optional visual companion serves local mockups and collects choice events.
Why you might use it
Use it when several plausible implementations could satisfy the request and the differences matter. It makes assumptions and approval points visible; the visual companion can make layout choices easier to discuss when the user accepts it.
Put it in context.
Illustrative requests and outputs to review. These examples are separate from the recorded evaluation below.
Scope an internal review screen
Example request
Help define a screen for reviewers to compare two synthetic answers. Start with the reviewer decision and existing project constraints; distinguish my requirements from your proposed defaults.
What to look for. A scoped description with explicit assumptions, followed by approval before building the agreed project.
Before you rely on it. The skill supports a skip-questions path. Use the amount of discussion the task needs, not a mandatory long interview.
Compare mockup layouts
Example request
Offer two local mockups for a review queue using synthetic rows only. Keep the companion on loopback, disable remote branding, and treat a spike as disposable until approved.
What to look for. A local visual comparison and a record of the selected direction.
Before you rely on it. Seven exported helper checks passed; the browser experience and HTTP security behavior remain untested. Review HTML and avoid sensitive records.
02 / Setup & access
What it asks of your environment.
Requirements
- An instruction-capable agent and a user who can confirm design decisions. Subagents are optional for the builder check.
- Optional visual companion: Node.js, a browser, a local listening port and Bash for the supplied launcher scripts. The text-only path needs none of those helper services.
- No hosted account is required. The default visual branding can reference a remote image; disable it when appropriate and review mockup assets separately.
Permissions & data access
- Read relevant project material; write a design document and, in a software project, commit it when authorized.
- Optional preview server reads/writes its session content and state, binds a local port and can launch a browser when explicitly enabled. Binding beyond loopback broadens access.
Instructions alone do not enforce a sandbox. The agent host, connected tools and approvals determine what the skill can actually read, change or send.
03 / Things to check
Security concerns & practical limits.
These concerns follow from the reviewed sources. They describe possible exposure or required review; they are not confirmed vulnerabilities.
Review before use
Local previews still contain active web content
The server inserts supplied HTML without sanitizing it and serves helper JavaScript. Its frame-ancestors policy is not an outbound-content sandbox. Use reviewed synthetic content, avoid secrets and do not load untrusted markup as a preview.
Review before use
Default branding can make a remote image request
Source inspection found a remote logo URL in rendered branding unless telemetry is disabled. The probe set SUPERPOWERS_DISABLE_TELEMETRY=1; no browser or remote asset request was made. That setting does not prevent arbitrary external assets in user-written mockups.
Review before use
Session keys and stored mockups need care
The optional server uses a session key in its bootstrap URL and cookie, and stores connection details and event data locally. Keep the default loopback bind, avoid sharing the key and check persistence and file access before using sensitive designs.
Limits and nuances
- Seven exported-helper cases ran on Node 24.18.0/Windows. They cover frame parsing, launcher argument construction and reconnect timing, not an end-to-end brainstorming conversation.
- The optional server started on loopback, but the sandbox denied HTTP connections (EACCES) and hardlink setup (EPERM). A scoped integration retry was not executed because the approval service reported a capacity error. No HTTP authorization or WebSocket integration pass is claimed.
- No browser, remote asset fetch, account, design commit, visual quality assessment, host-agent orchestration or startup/stop shell script was executed. No Windows ACL, network-exposure or broad security guarantee.
04 / Review record
What we checked. What’s still open.
Recorded review scope
- skills/brainstorming/SKILL.md
- LICENSE
- skills/brainstorming/builder-check-prompt.md
- skills/brainstorming/visual-companion.md
- skills/brainstorming/scripts/server.cjs
- skills/brainstorming/scripts/helper.js
- skills/brainstorming/scripts/frame-template.html
- skills/brainstorming/scripts/start-server.sh
- skills/brainstorming/scripts/stop-server.sh
Not tested or established
- Seven exported-helper cases ran on Node 24.18.0/Windows. They cover frame parsing, launcher argument construction and reconnect timing, not an end-to-end brainstorming conversation.
- The optional server started on loopback, but the sandbox denied HTTP connections (EACCES) and hardlink setup (EPERM). A scoped integration retry was not executed because the approval service reported a capacity error. No HTTP authorization or WebSocket integration pass is claimed.
- No browser, remote asset fetch, account, design commit, visual quality assessment, host-agent orchestration or startup/stop shell script was executed. No Windows ACL, network-exposure or broad security guarantee.
- Review date
- Source revision
bb92a77741419a4ab5f06e711a283343f1ada0c3- Our relationship
- Explored. Investigated through the recorded review. No use or replication is claimed.
Upstream content can change after review. A repository revision identifies source scope; it does not prove that every script, dependency or runtime behavior was tested. How freshness is handled.
Recorded evaluation / Helper probe
Results with their limits attached.
Seven exported upstream helper cases passed. The optional loopback server integration was attempted but blocked by host permissions; no full brainstorming workflow or HTTP security pass is claimed.
- Passed
- 7
- Failed
- 0
- Total recorded
- 7
These counts refer to the cases in this report. They are not a benchmark against other skills. A helper probe does not measure model task effectiveness or establish comprehensive security.
Read the evidence reportDownload the authored reproduction harness (JSON bundle) ↗
The report provides the case definitions, observations and baseline scope. Missing baselines or untested behaviors remain limitations.
Recorded environment
- Windows 11 x64; Node 24.18.0. Inspected pinned server/client helper modules; no added packages.
- Synthetic strings and frames only; no accounts, external requests, user browser or private data.
Recorded commands (2)
Commands document this evaluation. They are not setup instructions for your environment.
node brainstorm-module-probe.cjs <upstream-scripts> <result.json>Attempted: node brainstorm-probe.cjs <upstream-scripts> <new-fixture> <result.json>; host sandbox denied loopback client requests.Findings from this evaluation
Observation
Bounded protocol and launcher helpers passed
Seven upstream exported-helper cases passed: masked-frame parsing, rejection of unmasked and oversized frames, incomplete-frame handling, literal Windows launcher arguments, headless launcher selection and capped reconnect backoff. These are helper results, not an executed design workflow.
Needs attention
Local previews still contain active web content
The server inserts supplied HTML without sanitizing it and serves helper JavaScript. Its frame-ancestors policy is not an outbound-content sandbox. Use reviewed synthetic content, avoid secrets and do not load untrusted markup as a preview.
Needs attention
Default branding can make a remote image request
Source inspection found a remote logo URL in rendered branding unless telemetry is disabled. The probe set SUPERPOWERS_DISABLE_TELEMETRY=1; no browser or remote asset request was made. That setting does not prevent arbitrary external assets in user-written mockups.
Needs attention
Session keys and stored mockups need care
The optional server uses a session key in its bootstrap URL and cookie, and stores connection details and event data locally. Keep the default loopback bind, avoid sharing the key and check persistence and file access before using sensitive designs.
Observation
Approval paths are more specific than a universal gate
The current instructions allow clear small tasks and an explicit skip-questions path. Larger designs need approval; an accepted throwaway spike does not authorize keeping and extending it.
Evaluation limitations
- Seven exported-helper cases ran on Node 24.18.0/Windows. They cover frame parsing, launcher argument construction and reconnect timing, not an end-to-end brainstorming conversation.
- The optional server started on loopback, but the sandbox denied HTTP connections (EACCES) and hardlink setup (EPERM). A scoped integration retry was not executed because the approval service reported a capacity error. No HTTP authorization or WebSocket integration pass is claimed.
- No browser, remote asset fetch, account, design commit, visual quality assessment, host-agent orchestration or startup/stop shell script was executed. No Windows ACL, network-exposure or broad security guarantee.
05 / Reuse & discovery
License, attribution & popularity.
MIT
Repository MIT license text inspected at this revision. Preserve its copyright and permission notice when redistributing covered source; separate dependencies and services can have their own terms.
Why it is in this collection
skills.sh displayed 397.0K installs for this named skill on the observation date. Rounded directory telemetry; not verified unique users, a quality score or measured growth.
397,000 skill installs on skills.sh
- Scope
- Directory listing for superpowers-brainstorming; not the whole repository
- Observed
- Time window
- Individual listing says Installs; reporting window not independently established
Popularity and inclusion do not establish quality, compatibility or security. Counts belong to their named metric and date; they are not a current ranking.
06 / Follow the evidence
Go to the original.
- Pinned skill instructions github.com
- Pinned repository license github.com
- Reviewed builder-check-prompt.md github.com
- Reviewed visual-companion.md github.com
- Reviewed server.cjs github.com
- Reviewed helper.js github.com
- Reviewed frame-template.html github.com
- Reviewed start-server.sh github.com
- Reviewed stop-server.sh github.com
- Dated directory popularity context www.skills.sh
IonBin’s source notes are independent assessments. Upstream authors retain their work and attribution. This page does not install or execute the skill.