The Agent Skills Directory

[SAFE]: The skill communicates exclusively with the official Cursor API (api.cursor.com), which is a well-known and trusted service for developer tooling. All network requests are performed over HTTPS using secure protocols.
[SAFE]: Sensitive data is handled correctly by requiring the user to set a CURSOR_API_KEY environment variable. The skill never hardcodes credentials or attempts to exfiltrate them to unauthorized third-party services.
[SAFE]: The helper script scripts/cloud-agent.sh demonstrates secure coding practices by using the jq utility with explicit parameter binding (--arg, --argjson) to construct JSON payloads. This prevents injection attacks that could occur if strings were concatenated directly into JSON structures.
[SAFE]: Git workflows described in the documentation use double-quotes around variables (e.g., "$BRANCH" and "$commit"), which effectively mitigates risks associated with shell word-splitting or command injection from potentially manipulated branch names or commit hashes.

cloud-agents