Cursor, Plugin
Substrait Cursor Plugin
Build and deploy apps on the Substrait platform from Cursor — the substrait-app skill plus /substrait:login, /substrait:link, /substrait:deploy, /substrait:env and /substrait:library.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit e44982f94575, unchanged since the check below.
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
Why this grade
- NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
cursor-plugin/scripts/substrait-common.sh, line 145
# substrait_call METHOD PATH [extra curl args...] - SECRETS_PATH_DOTENV Low
Mentions a .env file.
cursor-plugin/skills/substrait-app/SKILL.md, line 52
.env.example # OPTIONAL - declare custom env vars + secrets (prefilled in the portal)
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
cursor-plugin/scripts/substrait-common.sh, line 145
# substrait_call METHOD PATH [extra curl args...]
cursor-plugin/scripts/substrait-common.sh, line 191
SUBSTRAIT_STATUS="$(curl -sS -o "$tmp" -w '%{http_code}' -X "$method" \
cursor-plugin/scripts/substrait-common.sh, line 199
# substrait_anon_call METHOD URL [extra curl args...]
Show more
cursor-plugin/scripts/substrait-common.sh, line 207
SUBSTRAIT_STATUS="$(curl -sS -o "$tmp" -w '%{http_code}' -X "$method" "$url" "$@" 2>/dev/null)"
cursor-plugin/scripts/substrait-deploy.sh, line 552
# Terminal states: drain any events written after our last fetch (the failure detail
cursor-plugin/scripts/substrait-update-check-cursor.sh, line 54
remote_ver="$(curl -fsS --max-time 5 "$RAW_BASE/.cursor-plugin/plugin.json" 2>/dev/null | _plugin_version)"
cursor-plugin/scripts/substrait-update-check-cursor.sh, line 57
remote_ver="$(curl -fsS --max-time 5 "$RAW_BASE/skills/substrait-app/SKILL.md" 2>/dev/null | _skill_version)"
cursor-plugin/skills/substrait-app/reference/object-storage.md, line 307
await fetch(signedUrl, {
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
cursor-plugin/skills/substrait-app/SKILL.md, line 52
.env.example # OPTIONAL - declare custom env vars + secrets (prefilled in the portal)
cursor-plugin/skills/substrait-app/reference/deploy-contract.md, line 228
# frontend/.env.production - build-time, PUBLIC-ONLY values
cursor-plugin/skills/substrait-app/reference/deploy-contract.md, line 248
.env*
Show more
cursor-plugin/skills/substrait-app/reference/deploy-contract.md, line 249
!.env.production
cursor-plugin/skills/substrait-app/reference/templates/backend/main.py, line 57
# Custom config you declared in .env.example is injected as env vars (set the real
cursor-plugin/commands/env.md, line 40
`backend/.env.example` (or a root `.env.example`), add any NEW variable you just
cursor-plugin/commands/env.md, line 43
secret values into the repo, and never commit a `.env` with real values.
cursor-plugin/commands/library.md, line 74
own secrets belong in `backend/.env.example` with a `# secret` marker, never in code.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit e44982f94575. can reach a host that is not written as a fixed address. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: e44982f945751798528809a4c016edf32203aebe
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.