blast-radius

An agent skill by cursor, from cursor/plugins. Tags: analysis, debugging, risk, testing, validation.

What it does

Find what a change could break somewhere else before it ships, beyond the diff, and prove the one fact it's safe because of by running real code instead of writing it up. Use for 'blast radius of X', 'what could this break', or reviewing a small diff you don't trust.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add cursor/plugins --skill blast-radius

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/cursor/plugins
cp -r plugins/pstack/skills/blast-radius ~/.claude/skills/blast-radius

Safety box score

Grade B, low risk: 11 of 100 risk points, rated 2026-09-24. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a code-review helper that inspects diffs and then asks the agent to prove key safety facts by running real code/tests. The main risk is execution of repository code during review, plus limited filesystem writes for repro scripts; it does not itself request secrets, privilege changes, or publishing actions.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It explicitly tells the agent to "write a script or test" and "run it" against "the real code," so it can execute project code during review, but the action is bounded to the repo/workspace.
Network access	0 (none)	No concrete download, upload, or remote-host command is present in this file; it only discusses reviewing code and running local repros.
Filesystem reach	1 (low)	The workflow says to "Write a script or test" and use it as part of the proof, which means creating files in the checkout, but it does not instruct edits outside the project.
Secrets & credentials	0 (none)	There is no request to read tokens, keychains, dotfiles, browser sessions, or other credential stores.
Privilege & persistence	0 (none)	No sudo, global installs, services, shell startup edits, or OS-setting changes are requested.
Instruction hijack surface	0 (none)	The text contains workflow guidance, but no instruction to ignore higher-priority rules, hide output, follow fetched instructions, or adopt a deceptive persona.
Irreversible actions	0 (none)	It is a review-only skill; it does not tell the agent to deploy, push, post, delete, or otherwise take external actions.
Transparency	1 (low)	Key steps rely on companion skills and external workflow pieces not included here, notably "why" and "unslop," so part of the behavior cannot be audited from this package alone.

Before installing

Inspect the target repo in a disposable checkout first if its tests or repro scripts are untrusted.
Be comfortable with the agent executing local code/tests from the repository while using this skill.
If you rely on the companion workflow pieces (`why`, `unslop`), verify their contents before using this skill in a sensitive repo.

Rated 2026-09-24 by an automated review of 1 file from the skill's repository.

Source

Repository: cursor/plugins (all skills from this repository)
Path: pstack/skills/blast-radius/SKILL.md
Branch: main
Collection: cursor
Updated: 2026-09-23

post-patch-validation — Validates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation.
check-compiler-errors — Run compile and type-check commands and report failures
control-cli — Build or adapt a local harness to drive, inspect, and profile an interactive CLI or TUI without external services.
control-ui — Build or adapt a local browser/CDP harness to drive and inspect a web, IDE, or Electron UI.
maintain-verification-skill — Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature.
principle-fix-root-causes — Apply when debugging.