explainx / blog
A GitHub repository with 140,000 stars has collected and published the full system prompts of Cursor, Claude Code, Windsurf, Copilot, Devin, v0, and 25+ other AI tools. Here''s what it reveals.
May 17, 2026
A deep dive into Agent Skills, the managed skill registry solving the security crisis in AI agent extensions. Learn how threat modeling, static analysis, and human curation make it safe to extend Antigravity, Claude Code, Cursor, and other professional coding agents with zero-trust workflows.
Jun 28, 2026
The explainx.ai skills registry is the canonical source for Claude Code and Cursor SKILL.md files. This guide explains how npx skills install works, what skills actually do, how to write your own, and how teams can use lockfiles to stay consistent in production.
Jun 24, 2026
Claude Code automatically appends a "Co-Authored-By: Claude Opus <[email protected]>" trailer to every git commit it creates. The debate is live on X: some engineers call it dishonest to remove it, others call it inappropriate to credit a tool. Here is where it comes from, why other AI coding tools do the same thing, and the exact steps to turn it off — including a one-line settings.json fix and a Claude Code skill that prevents it permanently.
A GitHub repository called system-prompts-and-models-of-ai-tools has quietly become one of the most-watched repos in the developer community—with over 140,000 stars and 34,600 forks. Its premise is simple and explosive: collect and publish the full internal system prompts of every major AI coding tool.
Cursor. Claude Code. Windsurf. Devin AI. v0. Replit. GitHub Copilot. Manus. All of them. In full.
Maintained by a developer known as x1xhlol (Lucas Valbuena), the repository at github.com/x1xhlol/system-prompts-and-models-of-ai-tools is organized into directories—one per tool. Each directory contains:
The list of exposed tools reads like the who's-who of AI-assisted development:
| Tool | What's Exposed |
|---|---|
| Cursor | Agent prompt v2.0, tool definitions |
| Claude Code | Sonnet 4.6 prompt |
| Windsurf | Multiple wave versions of tool definitions |
| GitHub Copilot (VSCode Agent) | Full agent prompt |
| Devin AI | DeepWiki prompt, tools |
| v0 (Vercel) | Full prompt and tools |
| Replit | Full system prompt |
| Lovable | Full system prompt (since deleted, still in repo) |
| Manus Agent | Prompt + all tool definitions |
| Perplexity | Full prompt |
| Warp.dev | Agent Mode prompt |
| Kiro | Full prompts |
| Junie | Coding agent system prompt |
| NotionAI | Prompt |
| Same.dev | Prompt |
| Trae | Builder prompt |
| Augment Code | GPT-5 tools JSON |
And many more. As of the repo's last update, 28 tools are documented.
Reading through these system prompts is a masterclass in how AI product teams think. A few patterns stand out.
Every tool extensively defines its identity. Cursor's prompt establishes a specific personality and philosophy for how it should approach coding tasks. Claude Code's prompt defines precise rules about tool use, asking for permission, and how to handle uncertainty. These aren't just vibes—they're detailed behavioral constitutions.
The tool definition JSONs are particularly revealing. They show exactly what actions each AI can take:
Comparing Cursor's tool set to Windsurf's or Devin's shows dramatically different philosophies about how much autonomy the AI should have by default.
Most prompts contain explicit instructions about what the AI must never do—refuse certain request types, always confirm before deletion, never exfiltrate data. Seeing these written out plainly shows the attack surface that each company is most worried about.
The Lovable directory is notable because the company deleted their prompt from the repo via a PR—but by then, it had already been forked 34,000+ times. The internet doesn't forget. This became a minor story in AI circles about the futility of trying to un-ring the bell once a system prompt is out.
The repo's 140K stars aren't just rubbernecking. There are legitimate reasons developers are studying these prompts:
Better prompting: Understanding how Cursor or Claude Code is instructed helps you phrase requests in ways the underlying model will handle better. If you know a tool's system prompt emphasizes asking for confirmation before changes, you can pre-empt that with "proceed without asking."
Competitive intelligence: For teams building AI dev tools, seeing competitors' architectural decisions—what tools they expose, what constraints they impose—is valuable product research.
Learning prompt engineering: These prompts, written by teams with massive resources and iteration cycles, are some of the best examples of production prompt engineering that exist. They're study material.
Security research: Understanding what an AI can and cannot do in an agentic context is critical for anyone deploying these tools in sensitive environments.
The repo's README includes a prominent security notice for AI startups:
"If you're an AI startup, make sure your data is secure. Exposed prompts or AI models can easily become a target for hackers."
The maintainer also links to ZeroLeaks, a service specifically designed to test AI systems for prompt extraction vulnerabilities. The security concern isn't just competitive—a well-crafted system prompt often contains information about internal architecture, backend services, or decision logic that bad actors could exploit.
The methods vary, but common techniques include:
The better-secured tools (like Claude Code) are significantly harder to extract from, but nothing is provably impossible given a determined adversary and enough interaction budget.
The existence and popularity of this repo signals something important: system prompts are not a competitive moat.
Any prompt-based differentiation is inherently reversible. The actual moat is:
Companies that have invested in deep integrations (Cursor's codebase indexing, Devin's sandbox environment, Claude Code's permissions system) are more defensible than those relying primarily on clever prompting.
Perhaps most interesting is the repo's "Open Source prompts" directory—a collection of prompts that developers and companies have intentionally published. This represents a different philosophy: transparency as a feature, not a vulnerability.
Some developers argue that open-sourcing your system prompt builds user trust, enables community improvement, and removes the false sense of security that comes with treating a text prompt as a secret.
| If you are... | What this means for you |
|---|---|
| A developer | Study these prompts — they're the best prompt engineering examples available |
| An AI product builder | Don't rely on system prompt secrecy for competitive advantage |
| A security engineer | Test your AI systems for prompt extraction before attackers do |
| A curious technologist | This repo is the most honest look at how AI products actually work |
The 140,000 developers who've starred this repo aren't doing it to cause trouble. They're doing it because understanding how these tools work—at the instruction level—makes them better builders.
The prompts are out there. The question is what you do with the information.
