Supernal Coding CLI

Supernal Coding CLI for development workflows - task management, requirements tracking, testing, git automation, ralph loops, compliance, and documentation....

Security Scan

The skill's instructions mostly match a developer CLI, but there are several mismatches and provenance gaps (undeclared env/config usage and an unverified npm install recommendation) that make it unclear and potentially risky to install or let an agent run autonomously.

Purpose & Capability

The SKILL.md describes a developer workflow CLI (task management, traceability, ralph/autonomous loops) which is consistent with the name. However the skill metadata declares no install or config requirements while the README explicitly instructs installing an npm package (@supernalintelligence/supernal-coding) and references storage locations (~/.supernal/tasks and .supernal/tasks/) and session linkage. The lack of source/homepage and discrepancy between declared requirements and referenced artifacts is a provenance/consistency concern.

Instruction Scope

The instructions direct running many local commands (task create/list/start/done, ralph execute, audit, compliance checks) and reference editing in $EDITOR, local storage paths, and linking to a dashboard at localhost:3006. They also mention an environment variable (OPENCLAW_SESSION_KEY) for session linkage that is not declared in the skill metadata. Because this is an instruction-only skill, those runtime behaviors are the entire surface — the SKILL.md permits actions that read/write local files and use an undeclared secret, which is an inconsistency and increases risk if an agent executes them.

Install Mechanism

There is no formal install spec in the skill metadata, yet SKILL.md tells the user to run `npm install -g @supernalintelligence/supernal-coding`. That mismatch is a red flag: the package source and publisher are unknown (no homepage/source listed), so following the README would install and execute third-party code without provenance. Instruction-only skills can be lower risk, but here the README explicitly pushes an external installation step.

Credentials

The skill metadata declares no required environment variables, but the SKILL.md references OPENCLAW_SESSION_KEY for session linkage and uses $EDITOR and local paths. The undeclared OPENCLAW_SESSION_KEY and the referenced storage paths (~/.supernal) suggest the skill expects credentials/configuration that are not documented in the metadata — an incoherence that could lead to accidental credential exposure or misconfiguration.

Persistence & Privilege

The skill is not set to always: true and does not declare system-wide privileges. However, the CLI described will create local storage under ~/.supernal and .supernal/tasks/ and can run autonomous 'ralph' loops which could persist state and execute repeated operations. The metadata omits these config paths, so users should expect the package to write persistent files if installed.

What to consider before installing

Before installing or enabling this skill, verify the package provenance and the missing metadata: ask the publisher for the upstream repository or npm package page and confirm the publisher identity. Do not run `npm install -g @supernalintelligence/supernal-coding` unless you can inspect the package source. Confirm whether OPENCLAW_SESSION_KEY and the ~/.supernal storage paths are required and what data they will hold. If an agent will be allowed to invoke this skill autonomously, restrict its ability to run npm installs or execute arbitrary shell commands until you can audit the code. If you cannot obtain a trusted source or code review, treat this as untrusted and avoid installing or granting the agent permission to run the CLI.

sc - Supernal Coding CLI

Development workflow automation, task management, requirements tracking, and autonomous task execution.

Canonical scope:

• sc is for developer/project workflow commands.
• orch is for orchestration runtime operations (capacity/spawn/triage/heartbeat/automation).
• Do not assume same-name commands across CLIs are semantic equivalents.

Installation

npm install -g @supernalintelligence/supernal-coding

Quick Reference

Task Management (PRIMARY)

sc task create "Title" --assignee @me --priority P2
sc task list                         # Your tasks  
sc task list --all                   # All repos
sc task list --status in-progress    # Filter by status
sc task view TASK-123                # View task details
sc task start TASK-123               # Begin work (sets in-progress)
sc task done TASK-123 --notes "..."  # Complete task
sc task next                         # Get next task (ralph mode)
sc task verify TASK-123              # Check evidence (optional)
sc task edit TASK-123                # Edit in $EDITOR

# Session linkage (dashboard only - requires localhost:3006)
sc task link TASK-123                # Link to current session (needs OPENCLAW_SESSION_KEY)
sc task link TASK-123 --session "..."  # Link with explicit session
sc task linked                       # List linked tasks
sc task unlink TASK-123              # Remove link

Storage: .supernal/tasks/ (per-repo) or ~/.supernal/tasks/ (global)

Workflow Guide: See docs/TASK_WORKFLOW.md for how tasks, requirements, features, and specs work together.

Project Health & Status

sc health                    # Run health checks
sc monitor                   # Development status dashboard
sc status                    # Alias for monitor

Requirements & Traceability

sc trace                     # Traceability matrix
sc planning                  # Manage epics, features, requirements, tasks
sc audit                     # Audit features, requirements, tests

Git & Workflow

sc git                       # Git workflow operations
sc git smart                 # Smart commits, branch management
sc workflow                  # Project workflow management

Ralph (Autonomous Loops)

sc ralph                     # Autonomous task execution
sc spec <action> [target]    # Spec file management for ralph loops

Code Quality

sc code <action>             # Code quality and contracts
sc compliance                # HIPAA, SOC 2, ISO 27001 validation
sc security                  # Database security verification

Documentation

sc docs                      # Documentation management
sc search <query>            # Search across all content

System

sc init [dir]                # Initialize project
sc update                    # Check for updates
sc system                    # Config, upgrade, sync, license

Common Patterns

New Feature Workflow

sc planning feature create "Add user auth"
sc spec create auth-feature.md
sc ralph execute auth-feature.md

Health Check Before PR

sc health
sc audit
sc compliance check

Knowledge & Workspace Hygiene

# Run knowledge store cleanup (pair with sc health)
know tidy              # Audit knowledge store
know tidy --fix        # Auto-fix issues (normalize tags, move misplaced files)
know reindex           # Rebuild INDEX.md
know validate          # Check frontmatter schema

# Recommended: add to heartbeat or nightly cron
know tidy --fix && know reindex

Traceability Report

sc trace report --format markdown

Integration with Agents

Task Assignment Flow

# Orchestrator assigns task
sc task create "Build API endpoint" --assignee @codex-coder --priority P1

# Agent picks up work
sc task next                # Get your next assigned task
sc task start TASK-123      # Mark as in-progress
# ... do work ...
sc task done TASK-123 --notes "Completed, PR #456"

Ralph Loops (Autonomous Execution)

# Create spec
sc spec create task-name.md

# Execute with ralph
sc ralph execute task-name.md --max-iterations 10

See orch skill for agent orchestration and spawning.