principle-prove-it-works

An agent skill by cursor, from cursor/plugins. Tags: analysis, qa, review, testing, validation.

What it does

Apply after completing a task, before declaring done. Verify against the real artifact (run the feature, read the actual value, inspect the diff), not a proxy, self-report, or 'it compiles.'

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add cursor/plugins --skill principle-prove-it-works

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/cursor/plugins
cp -r plugins/pstack/skills/principle-prove-it-works ~/.claude/skills/principle-prove-it-works

Safety box score

Grade A, minimal risk: 0 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is documentation-only: it tells an agent to verify results against the real artifact before saying a task is done. It does not include scripts, network calls, filesystem mutations, or credential handling, so the machine-risk surface is essentially nil.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	0 (none)	`SKILL.md` is plain guidance text and contains no shell commands, scripts, or code evaluation steps.
Network access	0 (none)	There are no download, upload, API, or remote-host instructions in the file; it only says to verify work locally.
Filesystem reach	0 (none)	The skill does not instruct reading, writing, or deleting any files beyond generic mention of keeping an artifact visible.
Secrets & credentials	0 (none)	No tokens, passwords, keychains, `.env` files, or login material are referenced.
Privilege & persistence	0 (none)	There is no sudo, service installation, shell startup editing, or other privilege-changing behavior.
Instruction hijack surface	0 (none)	The text does not ask the agent to ignore higher-level instructions, fetch external prompts, or hide anything; it is normal verification guidance.
Irreversible actions	0 (none)	It does not send messages, deploy, publish, pay, or delete anything; it only recommends checking the real output before declaring success.
Transparency	0 (none)	The content is fully readable markdown with no binaries, blobs, generated code, or unpinned remote dependencies.

Before installing

Read `SKILL.md` to confirm it is the only file in the skill and that no scripts are bundled with it.
If your environment auto-runs skills, verify this one is being used only as verification guidance and not as a source of executable commands.
No special security checks are needed beyond confirming the repo path contains no hidden native scripts or binaries.

Rated 2026-10-16 by an automated review of 1 file from the skill's repository.

Source

Repository: cursor/plugins (all skills from this repository)
Path: pstack/skills/principle-prove-it-works/SKILL.md
Branch: main
Collection: cursor
Updated: 2026-09-23

maintain-verification-skill — Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature.
principle-test-behavior-not-implementation — Apply when you write, change, or keep a test. Call the code the way its users do and assert the result they observe against a literal expected value.
qa-expert — This skill should be used when establishing comprehensive QA testing processes for any software project.
verify-and-stop — Prove existing work meets acceptance conditions without expanding scope.
blast-radius — Find what a change could break somewhere else before it ships, beyond the diff.
no-comments — Spawn Comment Sicko, fix accepted findings, and offer encodings for claimed constraints.