Cursor, Plugin
Ai Plugin
PubNub plugin for Cursor
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit ecae64f2272c, unchanged since the check below.
PERMISSION_SHELL_UNDECLARED
Why this grade
- PERMISSION_SHELL_UNDECLARED Medium
Runs shell commands that the manifest or description does not mention.
skills/pubnub-keyset-management/evals/scenario-2/task.md, line 13
1. Execute `git diff --cached` (using `child_process.execSync` or equivalent) and capture stdout as a UTF-8 string.
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
requests shell access. No manifest field names shell or command execution.
PERMISSION_SHELL_UNDECLARED
skills/pubnub-keyset-management/evals/scenario-2/task.md, line 13
1. Execute `git diff --cached` (using `child_process.execSync` or equivalent) and capture stdout as a UTF-8 string.
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach db-writer.example.com. The description does not name that host. can reach example.com. The description does not name that host. can reach api.moderation.example.com. The description does not name that host. can reach a host that is not written as a fixed address. can reach api.crm.example.com. The description does not name that host. can reach admin-api.pubnub.com. The description does not name that host. can reach api.example.com. The description does not name that host. can reach you
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
skills/pubnub-functions/references/db-triggers-and-runtime-quirks.md, line 42
await xhr.fetch('https://db-writer.example.com/insert', {
skills/pubnub-functions/references/functions-chaining.md, line 207
await xhr.fetch('https://example.com/notify', {
skills/pubnub-functions/references/functions-patterns.md, line 110
const response = await xhr.fetch('https://api.moderation.example.com/check', {
Show more
skills/pubnub-functions/references/functions-patterns.md, line 160
await xhr.fetch(slackUrl, {
skills/pubnub-functions/references/functions-patterns.md, line 177
await xhr.fetch('https://api.crm.example.com/events', {
skills/pubnub-illuminate/references/business-objects.md, line 42
curl -X POST https://admin-api.pubnub.com/v2/illuminate/business-objects \
skills/pubnub-illuminate/references/business-objects.md, line 99
curl -X PUT https://admin-api.pubnub.com/v2/illuminate/business-objects/<bo-id> \
skills/pubnub-illuminate/references/dashboards.md, line 44
curl -X POST https://admin-api.pubnub.com/v2/illuminate/dashboards \
Secrets
Note
reads an environment variable.
SECRETS_ENV_READ
skills/pubnub-history/references/offline-catch-up.md, line 27
subscribeKey: process.env.PN_SUBSCRIBE_KEY,
skills/pubnub-history/references/offline-catch-up.md, line 43
subscribeKey: process.env.PN_SUBSCRIBE_KEY,
skills/pubnub-illuminate/references/service-integration-auth.md, line 100
'Authorization': process.env.ILLUMINATE_API_KEY,
Show more
skills/pubnub-keyset-management/SKILL.md, line 76
publishKey: process.env.PN_PUBLISH_KEY,
skills/pubnub-keyset-management/SKILL.md, line 77
subscribeKey: process.env.PN_SUBSCRIBE_KEY,
skills/pubnub-keyset-management/SKILL.md, line 78
secretKey: process.env.PN_SECRET_KEY,
skills/pubnub-keyset-management/references/custom-origin.md, line 60
publishKey: process.env.PN_PUBLISH_KEY,
skills/pubnub-keyset-management/references/custom-origin.md, line 61
subscribeKey: process.env.PN_SUBSCRIBE_KEY,
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains an encoded blob in a file that should be readable.
OBFUSCATION_ENCODED_BLOB
skills/pubnub-observability/references/cost-and-payload-hygiene.md, line 1
# Cost and Payload Hygiene
assets/pubnub-logo.svg, line 7
<image id="image0_2411_53618" width="1520" height="448" preserveAspectRatio="none" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABfAAAAHACAYAAADtD0nJAAAACXBIWXMAACxLAAA
Licence
Note
no licence file found.
LICENCE_MISSING
No file path was stored.
no licence file found.
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit ecae64f2272c. requests shell access. No manifest field names shell or command execution. can reach db-writer.example.com. The description does not name that host. can reach example.com. The description does not name that host. can reach api.moderation.example.com. The description does not name that host. can reach a host that is not written as a fixed address. can reach api.crm.example.com. The description does not name that host. can reach admin-api.pubnub.com. The description does not name that host. can reach api.example.com. The description does not name that host. can reach you reads an environment variable. contains an encoded blob in a file that s
Date and source
Date checked:
github.com
Commit graded: ecae64f2272caaf626942d15a5ee09553ff88ce8
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.