how
An agent skill by cursor, from cursor/plugins. Tags: analysis, architecture, debugging, development, documentation.
What it does
Use for "how does X work", code walkthroughs before changing something, and placement / ownership / layering questions ("where should this live", "which package owns this", "is this the right layer"). Explains subsystem architecture, runtime flow, onboarding mental models. Use why for motivation.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add cursor/plugins --skill howOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/cursor/plugins
cp -r plugins/pstack/skills/how ~/.claude/skills/howSafety box score
Grade A, minimal risk: 4 of 100 risk points, rated 2026-09-25. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is a read-only codebase exploration helper for answering architecture and "how does X work" questions. It spawns read-only explorer/explainer subagents and uses repository browsing tools only, so the main exposure is broad read access to whatever is in the repo rather than code execution or file changes.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 0 (none) | The skill only instructs agents to use `Read`, `Grep`, and `Glob`; there are no shell commands, scripts, or code evaluation steps. |
| Network access | 0 (none) | There are no downloads, uploads, or remote API calls specified anywhere in `SKILL.md` or the prompt templates. |
| Filesystem reach | 1 (low) | It explicitly explores the codebase with `Read`, `Grep`, and `Glob`, but all subagents are marked `readonly: true` and no writes or deletes are requested. |
| Secrets & credentials | 0 (none) | The skill does not ask for tokens, passwords, `.env` files, or other credential stores, and it never requests the user to paste secrets. |
| Privilege & persistence | 0 (none) | There is no `sudo`, global install, service registration, or shell/OS configuration change in the shipped files. |
| Instruction hijack surface | 0 (none) | The prompts do not tell the agent to ignore its rules, hide behavior, or follow remote instructions; they are standard analysis instructions only. |
| Irreversible actions | 0 (none) | The skill only produces an explanation; it does not push, post, deploy, pay, delete, or otherwise act on external systems. |
| Transparency | 0 (none) | The shipped assets are plain markdown files; there are no binaries, bundled installers, base64 blobs, or unreviewable generated code. |
Before installing
- Confirm you are comfortable granting the skill read access to the repository contents it will inspect.
- Check the full skill directory for any non-markdown files if the repository changes later; the reviewed version is markdown-only.
- Skim `references/explorer-prompt.md` and `references/explainer-prompt.md` to verify they remain read-only and do not add external fetches or secret handling.
Rated 2026-09-25 by an automated review of 3 files from the skill's repository.
Source
- Repository
- cursor/plugins (all skills from this repository)
- Path
- pstack/skills/how/SKILL.md
- Branch
- main
- Collection
- cursor
- Updated
- 2026-09-23
Related skills
- what-did-i-get-done — Summarize authored commits over a user-specified time period into a concise update
- audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.
- diagramming-code — Generates Mermaid diagrams from Trailmark code graphs.
- trailmark-summary — Runs a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list.
- context7-docs — Fetch up-to-date documentation and code examples for any library, framework, SDK, CLI tool, or cloud service.
- domain-modeling — Build and sharpen a project's domain model. Use when discussing codebase terminology, writing or editing a GLOSSARY.md, or recording or editing an ADR.