The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes the local cursor-agent and git binaries through wrapper scripts (cursor-review-changes.sh, cursor-ask.sh, cursor-doctor-check.sh). These scripts use set -euo pipefail and handle arguments carefully to prevent shell injection. The cursor-agent invocation defaults to --mode plan or --mode ask, ensuring a read-only stance for external reviews.
[DATA_EXFILTRATION]: While the skill transmits data to Cursor's external agent, it includes explicit guidelines and activation rules to check for secrets, private data, or production credentials before transmission. It provides a --dry-run flag in all scripts, allowing users to inspect the prompt and command before actual execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of git diffs and context files.
Ingestion points: scripts/cursor-review-changes.sh reads git diffs; scripts/cursor-ask.sh reads arbitrary context files.
Boundary markers: Prompts in templates/ use clear Markdown headers (e.g., # Change Context, Context:, Task:) to separate instructions from data.
Capability inventory: Capabilities are limited to calling cursor-agent (configured for read-only) and git for status/diffs.
Sanitization: Scripts implement truncation (max_diff_bytes and line limits for context files) and binary file detection (using grep -Iq) to prevent large or malformed payloads from disrupting the model.
[REMOTE_CODE_EXECUTION]: The skill depends on a well-known external tool (cursor-agent). There are no patterns of downloading and executing remote scripts (e.g., curl | bash). The logic for execution is entirely local and scoped to the provided scripts.
[SAFE]: The skill follows best practices for agent-to-agent delegation, including reconciling external feedback against local evidence and treating the external model's output as a 'second opinion' rather than a definitive authority.

cursor-cli