shipshitdev/blast-radius
skills/blast-radius/SKILL.md
Find what a small-looking change could break somewhere else, and prove the one fact it is safe because of by running real code. Use for blast radius of X, what could this break, or reviewing a small diff you do not trust.
$ install --global
skillsauthnpx skillsauth add shipshitdev/library blast-radiusInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Aug 31, 2026, 2:41 AM317.1s3 files scanned
SKILL.md
- name:
- blast-radius
- description:
- Find what a small-looking change could break somewhere else, and prove the one fact it is safe because of by running real code. Use for blast radius of X, what could this break, or reviewing a small diff you do not trust.
- disable-model-invocation:
- true
- license:
- MIT
- version:
- 1.0.0
- tags:
- impact, safety, review, verification
- author:
- Ship Shit Dev
- source:
- https://github.com/cursor/plugins/blob/main/pstack/skills/blast-radius/SKILL.md
- upstream_repo:
- cursor/plugins
- upstream_ref:
- main
- upstream_commit:
- bdf7aa355337
- last_synced:
- 2026-08-26
- when_to_use:
- blast radius, what could this break, is this small diff safe
Blast radius
Find what a change breaks somewhere else, before it ships. Companion
to how and why. Listing callers is not the job. The job is the
breakage grep will not show you.
Contract
Inputs:
- A diff, PR, or proposed change that looks small
Outputs:
- What it does, the one safety fact (proven or marked unproven), confirmed risks, cleared checks, and the cheapest merge-time test
Creates/Modifies:
- An optional proof script under the current repo
.tmp/
External Side Effects:
- Runs local proof scripts or tests. No production writes.
Confirmation Required:
- None for the analysis. Proof scripts stay local unless the caller commits them.
Delegates To:
whystep 2 for PR and commit anchorsarenafor a wide change that needs several independent reads
How sure are you
For each safety fact, get as far down this list as is cheap, and say where it stopped.
- You said so. Worthless on its own.
- You pointed at the line.
- You walked the bad case and it does not reach.
- You ran it. A script or test that calls the real code.
- You reproduced it in the running app.
Any safety fact you cannot get to step 4, say so out loud.
Steps
- Read the change, including the part the diff does not spell out.
- Find the one fact it is safe because of.
- Look where grep stops: library source, pinned versions, timing, wire formats, feature flags, three hops downstream.
- Be honest about each risk. Cite a real
file:line. A search that finds nothing is still an answer. - Prove the one fact. Run real code. Paste what happened.
- For a big or wide change, run it as an
arena.
What to hand back
- What it does. Including the part that is not obvious.
- The one fact it is safe because of. State it, say which step you got it to, and show the proof.
- Risks. Only the real ones.
- Cleared. What you checked and why it is fine.
- Before you merge. The cheapest test or repro that catches the real bug.
Related Skills
shipshitdev/weekly-review
development
VerifiedTrustedCommunity
Coordinates a weekly engineering review of board accuracy, recent code changes, operational health, and scoped cleanup. Use for a recurring repository health review or a review of the last several days.
35SKILL.mdUpdated Sep 6, 2026
shipshitdev/project-board
testing
VerifiedTrustedCommunity
Audits project board configuration and prepares explicitly requested setup, copy, or normalization changes while preserving the existing workflow and provider boundaries. Use when inspecting a board's fields, columns, scope, or configuration.
35SKILL.mdUpdated Sep 6, 2026
shipshitdev/board-sync
testing
VerifiedTrustedCommunity
Reconciles a project board with current work and delivery evidence, reports incomplete coverage and metadata gaps, and applies only approved provider-supported field changes. Use when auditing board drift, reviewing blocked work, or assessing upcoming delivery.
35SKILL.mdUpdated Sep 6, 2026
shipshitdev/how
development
VerifiedTrustedCommunity
Walk through how a subsystem works. Use for "how does X work", code walkthroughs before changing something, and placement or ownership questions. Explains architecture, runtime flow, and onboarding mental models. Can critique architecture. Use why for motivation.
35SKILL.mdUpdated Aug 31, 2026