plugins/explain/skills/explain/SKILL.md
Use when user invokes /explain with a file path, directory path, function/class name, or natural language concept. Also triggers on "explain this", "how does X work", "walk me through". Produces a structured, layered explanation of what the code does, how it connects, and where to start if you need to change it. Do NOT use when the user wants to trace data flow through a pipeline — use /lineage instead.
npx skillsauth add harnessprotocol/harness-kit explainInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Produce layered explanations of code — files, directories, functions, classes, or cross-cutting concepts. Designed for developers working in unfamiliar parts of a codebase.
Core principles:
User types /explain followed by:
/explain src/auth/middleware.ts
/explain the payment processing flow
/explain src/services/
/explain OrderProcessor.process
/explain how webhooks get dispatched
You MUST follow this order. No skipping steps.
Classify the argument:
| Type | Detection | Example |
|------|-----------|---------|
| File path | Has file extension or resolves to a file | src/auth/middleware.ts |
| Directory path | Resolves to a directory (or ends with /) | src/services/ |
| Symbol name | Looks like a function, class, or method (CamelCase, dot notation, ::) | OrderProcessor.process |
| Concept | Natural language, doesn't resolve to a file or directory | the payment processing flow |
If ambiguous (e.g., auth could be a directory or a concept), check the filesystem first. If it resolves to a file or directory, treat it as that. Otherwise, treat it as a concept.
For a file path:
*.ts, *.py, *.go, etc. to avoid noise from docs, tests, and build output)For a directory path:
For a symbol name:
function symbolName, class SymbolName, def symbol_name, func symbolName (adjust for the project's language). Filter to source file types.For a concept:
Look for project-level CLAUDE.md in the repository root:
CLAUDE.md in the working directory or its parent directoriesIf no CLAUDE.md exists, proceed without it — this step is additive, not blocking.
Before producing the explanation, determine what scope is appropriate:
Use this structure. Every section is required for narrow/medium scope. For wide scope, produce the map version (see Step 4).
1. Summary (2-3 sentences)
What this code does and why it exists. Lead with purpose, not implementation details.
2. Key Components
The important pieces — functions, classes, modules, config — with one-line descriptions. Use a table or bullet list:
- `authenticate()` — validates JWT token from Authorization header, attaches user to request context
- `requireRole(role)` — middleware factory that checks user.role against the required role
- `rateLimiter` — token bucket rate limiter, configured per-route in config.yml
3. How It Connects
What calls this code, what this code calls, and how data flows in and out. Be specific about entry points and dependencies:
Called by:
- Express router (src/routes/api.ts:14) — applied to all /api/* routes
Calls:
- UserService.findById() — to hydrate user from token claims
- config.get('auth.jwtSecret') — for token verification
Data flow:
- IN: Authorization header (Bearer token)
- OUT: req.user object attached to request, or 401 response
4. Patterns & Conventions
Design patterns used, naming conventions, framework idioms. Only include patterns that are actually present — don't list patterns that aren't used.
Examples: middleware chain pattern, repository pattern, dependency injection, event-driven, pub-sub, factory pattern, decorator pattern.
5. Gotchas
Non-obvious behavior, edge cases, known issues, things that will bite you. If there are no gotchas, say "None identified" rather than inventing them.
Examples:
6. Entry Points for Change
If you need to modify this code, where to start and what to watch out for. Be practical:
- To add a new auth provider: implement the AuthProvider interface in src/auth/providers/,
register it in src/auth/registry.ts
- To change token expiry: update config.yml (auth.tokenExpiry), but note that existing
tokens will still use their original expiry
- To add rate limit exemptions: add the route pattern to rateLimiter.exemptions in config.yml
End with: "Want me to go deeper on any section, or explain a related part of the codebase?"
For wide-scope explanations (directories/concepts), be more specific: list the components you can deep-dive into.
| Mistake | Fix | |---------|-----| | Reading every file in a directory | Read the map (ls), identify key files, read those. Offer to go deeper. | | Inventing gotchas that aren't real | Only list gotchas you actually observed in the code. "None identified" is fine. | | Generic patterns section | Only list patterns that are concretely present in the code. Skip if nothing notable. | | Ignoring CLAUDE.md | If it exists, use its Architecture section to contextualize the explanation. | | Wall of text with no structure | Always use the 6-section structure. Use code blocks, tables, and bullet lists. | | Explaining language basics | Assume the reader knows the programming language. Explain the code's purpose and design, not syntax. | | Not searching for callers | "How It Connects" requires knowing what calls this code. Always search for callers. | | Dumping raw search output | Synthesize search results into a coherent explanation. The user wants understanding, not search results. |
development
Use when you've planned a non-trivial change and are about to implement it, finished a complex or multi-file piece of work, just wrote tests, or are stuck on repeated failures — and any time the user says "rubber duck this", "rubber ducky", "get a second opinion", "sanity-check my plan", "poke holes in this", "what am I missing", "critique my approach", "review this before I build it", or "/rubber-ducky". Spawns independent read-only critics on DIFFERENT Claude models than the one driving the session to catch blind spots, design flaws, and substantive bugs while course corrections are still cheap. Skip it only for small, obvious, well-understood changes. Do NOT use for reviewing a finished diff or PR — use /review for that; rubber-ducky pressure-tests your own in-progress thinking before and during implementation.
tools
Use when the user wants to fix, address, clear, or resolve open Dependabot security/vulnerability alerts for a repository, end to end. Fetches open alerts via the gh CLI, fixes them per ecosystem (pnpm/npm overrides + lockfile regen, cargo update, pip/go/bundler), verifies with audit and frozen-lockfile installs, then branches → commits → pushes → opens a PR, and squash-merges once CI is green — escalating only when a fix carries breaking-change risk or can't be resolved. Trigger on "/dependabot-sweep", "address the dependabot alerts", "fix the security vulnerabilities", "clear the dependabot alerts", "handle the dependency vulnerabilities", "sweep dependabot".
tools
Harness Kit documentation — installation, plugin catalog, creating plugins, cross-harness setup, architecture, and FAQ. Use when working with or configuring harness-kit plugins, understanding the plugin/skill system, installing slash commands, setting up AI coding tool configuration, answering questions about the plugin marketplace, writing SKILL.md files, using harness.yaml, or integrating with Copilot, Cursor, or Codex. Do NOT use for general Claude Code questions unrelated to harness-kit.
development
Use when user invokes /stats or asks about Claude Code usage, token consumption, session history, model distribution, or activity patterns. Generates an interactive HTML dashboard with charts and tables, auto-opens in browser. Also triggers on "how much have I used Claude", "show my usage", "token usage", "session stats", "usage report", "usage dashboard". Do NOT use for API billing or cost estimation — token counts are not costs.