cursor-ask

cursor-ask is a skill for Claude Code, Codex from Chachamaru127/claude-code-harness. It costs 118 tokens per session (2,908 once invoked), scanned B, original, MIT.

A read-only way to ask Cursor's Composer coding assistant for questions, investigations, design opinions, or adversarial checks. It cannot edit files or run commands.

In plain words
What is it for?
Use it to investigate errors, search project files, discuss designs, review changes, and identify the main weakness in a proposed approach.
Why use it?
It gives you a second opinion without changing the project, which helps uncover bugs, weak assumptions, or maintenance risks before implementation.

Skill for Claude CodeCodex

Installs and runs on its own, but its text points at files inside its plugin — anything it tells you to read at a ${CLAUDE_PLUGIN_ROOT} path is only there once the plugin is installed. Installing the plugin gets both.

Part of the claude-code-harness plugin — 25 skills, 5 commands, 5 agents, 27 hooks shipped together

About the project

Claude Code Harness is a development workflow for coding agents that organizes work into planning, implementation, review, synchronization, and release stages. It helps developers keep specifications, tests, independent reviews, and release evidence connected while using tools such as Claude Code, Codex CLI, Cursor, or Grok.

Chachamaru127/claude-code-harness · 3,082 stars · on GitHub

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/chachamaru127/claude-code-harness/cursor-ask
Any agent
npx skills add Chachamaru127/claude-code-harness --skill cursor-ask
Clone the repo
git clone --depth 1 https://github.com/Chachamaru127/claude-code-harness

Made for: Claude Code, Codex.

Or install claude-code-harness, the plugin that ships this one along with the rest of its 25 skills, 5 commands, 5 agents, 27 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for cursor-ask

README.md
[![agentmods](https://agentmods.dev/badge/skills/chachamaru127/claude-code-harness/cursor-ask.svg)](https://agentmods.dev/skills/chachamaru127/claude-code-harness/cursor-ask)
Your own site
<a href="https://agentmods.dev/skills/chachamaru127/claude-code-harness/cursor-ask"><img src="https://agentmods.dev/badge/skills/chachamaru127/claude-code-harness/cursor-ask.svg" alt="Measured on agentmods" height="20"></a>
Per session 118 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,908 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 2 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00118 $0.02908
Opus 5 $0.00059 $0.01454
Sonnet 5 $0.00024 $0.00582
Haiku 4.5 $0.00012 $0.00291

Measured 5d ago against content hash f55ca00bb016, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

cursor-ask scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

| Egress allowlist | `~/.claude/settings.json` の `sandbox.network.allowedDomains` に `*.cursor.sh` を追加 | user settings |

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

| 調査 | "scripts/ 配下で curl を使ってる箇所を全部挙げて理由付きで" |
codex/.codex/skills/cursor-ask/SKILL.md · 198 lines

How it starts

The opening of the file, as written. The whole thing — 198 lines — stays where its author put it; the contents beside it link to each section on GitHub.

cursor:ask — Read-Only Cursor Delegate

cursor-agent (Composer) に read-only で質問・調査・設計相談・敵対的レビューを委譲する軽量スキル。

cursor-companion.sh task は引数なしで --mode ask (hard read-only stop) が自動で付くため、--write を渡さない限り cursor 側は ファイル書き込み・コマンド実行ができない。これにより worktree 隔離・cherry-pick・Lead diff review がすべて不要になる。

Quick Reference

cursor:ask "この設計判断、Composer 視点でどう思う?"
cursor:ask "TASK_BASE_REF からの diff を読んで、見落としを 3 つ挙げて"
cursor:ask "harness-mem の cross-project N-call、楽観的すぎる前提はある?"

用途:

ケース
質問 "この型エラーの根本原因は?"
調査 "scripts/ 配下で curl を使ってる箇所を全部挙げて理由付きで"
設計相談 "この abstraction、3 年後に保守できる?"
敵対的視点 "この PR の最大の弱点を 1 つだけ挙げて"

Narration Rules (UX Contract)

敵は 冗長さ であって進捗報告ではない。起動時に何を聞くか・どう進めるかを簡潔に明示してから実行する。冗長な繰り返し・中身のない前置きだけを禁ずる。

起動時に必ず出すもの (banner + plan、3 行以内)

🚀 cursor / composer-2.5-fast / ask
これから: <質問の要点> を composer に投げて、結果を 3-5 行で要約

banner 1 行 + 計画 1-2 行。1 秒以内に出し、即 Step 2 へ。

進捗報告は出してよい

  • 委譲開始の 1 行 (→ composer に問い合わせ中)
  • 判断に必要な経緯を 1 行で

禁止 (= 冗長さ)

  • 同じ事実の 2 回言い換え: cursor-companion の結果を後段で再説明しない
  • 中身のない前置き: 「使い方を確認します」だけの行など tool call で自明な宣言
  • 3 行以上の経緯振り返り: 必要なら 1 行に圧縮
  • 起動シーケンス中の ★ Insight ブロック: Insight は最終要約で 1 回のみ

違反例 (冗長):

× 「cursor に質問を投げる準備をします」→ bash → 「投げます」(中身のない前置き + 言い換え)
× 「ask モードは読み取り専用なので安全です」と再説明(既知事実の繰り返し)
× ★ Insight ──── まず cursor の状態を確認します: ...

正常例 (簡潔 + 計画明示):

🚀 cursor / composer-2.5-fast / ask
これから: 設計の弱点を composer に問い、結果を 3-5 行で要約

Execution Flow

Step 0: 起動時 banner + plan

上記 Narration Rules に従い、banner + 計画 (3 行以内) を出してから Step 1 へ。

Step 1: banner 確認

Step 0 で banner + 計画 (3 行以内) は出し切っているので、ここでは banner 行が出ていることを確認する。banner は:

🚀 cursor / composer-2.5-fast / ask

以降は委譲開始の 1 行ステータス等で進捗を見せてよい。冗長な繰り返しのみ避ける。

composer-2.5-fastscripts/model-routing.sh --host cursor --role worker --field model で解決される値の代表表記。実際の resolved model は cursor-companion 側のログに出る。

Step 2: helper root 解決 + cursor-companion 直接実行

$ARGUMENTS を質問文として渡す。--write は絶対に付けないscripts/cursor-companion.sh を相対パスで呼ぶと consumer repo の cwd 直下に見えず exit するため、CLAUDE_PLUGIN_ROOT / HARNESS_PLUGIN_ROOT を hooks.json と同じ valid_root パターンで解決する (Issue #193 §2):

Read the full file on GitHub · 198 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 198 lines · 118 tokens per session scan B f55ca00bb016

Subscribe to this mod's changes

cursor-ask is a skill published in the GitHub repository Chachamaru127/claude-code-harness (3,082 stars, last pushed 4d ago), licensed MIT. It adds 118 tokens to every session and 2,908 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it B with 2 findings (reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

brainstorming

You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.

obra/superpowers · 37 tokens

auto-perf-optimize

Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.

microsoft/vscode · 62 tokens

chat-perf

Run chat perf benchmarks and memory leak checks against the local dev build or any published VS Code version. Use when investigating chat rendering regressions, validating perf-sensitive changes to chat UI, or checking for memory leaks in the chat response pipeline.

microsoft/vscode · 51 tokens

chat-pet-sprite-creation

Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.

microsoft/vscode · 53 tokens

cpu-profile-analysis

Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…

microsoft/vscode · 71 tokens