Every system that involves LLM agents, tool use, or prompt construction MUST treat AI safety as a first-class constraint. Prompt injection is the SQL injection of the AI era — and it's harder to fix after deployment.

Applies 7 quality dimensions adapted for infrastructure-as-code, CI/CD pipelines, and DevOps workflows. Every dimension must pass before the current IaC change proceeds to `/gsd:plan-phase`. A ❌ is a hard stop — redesign before continuing.

Maps the current DevOps context (IaC tool, cloud provider, task type) to the best available plugin skill. Silver Bullet's devops-cycle workflow references this router at contextual trigger points — it is NOT a required workflow step.

Every design, plan, and implementation MUST allow new functionality to be added without modifying existing code. The system should be open for extension but closed for modification.

Every design, plan, and implementation MUST produce small, focused modules where any single change touches the fewest files possible and every touched file fits comfortably in context.

Every design, plan, and implementation MUST handle failure gracefully. Things WILL go wrong — networks fail, disks fill up, dependencies go down, inputs are invalid. The question is not "will it fail?" but "what happens when it does?"

Every design, plan, and implementation MUST produce components that are written once and reused everywhere applicable. Duplication is a bug — not in logic, but in design.

Every design, plan, and implementation MUST treat security as a first-class constraint, not an afterthought. Vulnerabilities are bugs — the most expensive kind.

Use this skill any time a deferred item, skipped work, technical debt, bug, open question, or enhancement is identified and must be tracked. It classifies the item as an issue or backlog entry, routes it to the correct PM destination based on the project's `issue_tracker` setting, and returns a stab

Use this skill when the root cause of a failure is **unknown and must be reconstructed from evidence**. This covers: completed sessions that left things broken, abandoned or timed-out sessions, step 7 verification failures, and mid-session stalls.

Use this skill any time a project-scoped insight or portable lesson is identified and should be preserved. It is called by the coding agent at the finalization step (per doc-scheme.md "Every task" row) and by `/silver-scan` for retroactive capture. It classifies the insight, routes it to the correct

Use this skill any time a tracked work item must be removed. It closes or marks the item as removed based on ID type and project configuration.

Enforces safe AI usage practices, prevents prompt injection, and ensures model safety

Triages artifact reviewer findings into MUST-FIX / NICE-TO-HAVE / DISMISS based on artifact contract -- prevents over-zealous reviews

> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.

Delegate the current phase's implementation work from Claude-SB to a Forge subagent under the parent's existing phase-lock. Spawns `forge -p <envelope>` with SB_PHASE_LOCK_INHERITED=true so the child does not double-claim, then integrates the structured Forge result into the parent phase artifacts.