Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 1 to 48 of 48 Cursor, Grade C entries. Page 1 of 1.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
assets/public/fonts/fa-brands-400.svg:1 <?xml version="1.0" standalone="no"?>mcp (Plugin)
Compatibility: Not stated.
Official VidGuy MCP connection configs for Gemini CLI, Cursor, and other AI assistants
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
skills/pubnub-keyset-management/evals/scenario-2/task.md:13 1. Execute `git diff --cached` (using `child_proceAi Plugin (Plugin)
Compatibility: Not stated.
PubNub plugin for Cursor
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zSO0KQV50" style="display:none">qXV3zM65KV8LinJ/XzKdI7Cwa9F7hrleCFm+zlPGp5WfaHvGzKluJVLHAi Site Forge (Plugin)
Compatibility: Not stated.
**Sitemd Flow** is a declarative pipeline framework designed for AI coding agents that build static websites.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
packages/engineering/src/agent-tools.ts:542 /(^|\/)(\.env($|\.)|.*secrets?.*|.*credentials?.*|.*\.pem$|.*\.keyarcframe (Plugin)
Compatibility: Not stated.
ocal-first repository intelligence for Cursor MCP and AI coding agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/dependencies.mjs:191 try { fs.unlinkSync(destination); } catch { /* best effort cleanup */ }astack (Plugin)
Compatibility: Not stated.
Evidence-first engineering: a six-command Cursor plugin and a portable Agent Skill.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/auditing/references/audit-checks.json:131 {"id": "OC5", "category": "security/opencode_plugins", "groupBundles Forge (Plugin)
Compatibility: Portable across standard formats.
An agentic skills framework & bundle-plugin engineering toolkit that works.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST
causal_graph/storage.py:19 os.remove(tmp)Causal Graph Harness (Plugin)
Compatibility: Not stated.
Auditable causal-graph research plus an optional opportunity-scout skill that helps agents avoid premature verdicts and notice practical next moves.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.cursor/hooks/trust_report.py:325 completed = subprocess.run(Corporate Site Harness (Plugin)
Compatibility: Not stated.
Evidence-gated Cursor delivery: digest-bound gates, corporate/site role split, factory control plane.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
mcp/tools/runtime.py:57 completed = subprocess.run(Cursor Odoo Plugin (Plugin)
Compatibility: Not stated.
Cursor Odoo Developer Plugin
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/install-local.mjs:81 fs.rmSync(LINK_PATH, { recursive: true, force: true });Cursor Plugin (Plugin)
Compatibility: Not stated.
AgentStack for Cursor: full backend ecosystem (8DNA, Rules Engine, Buffs, Payments) and 700+ MCP tools.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:8 id_rsaCursor Plugin (Plugin)
Compatibility: Not stated.
The shared memory and data layer for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
skills/rightbrain-tasks/SKILL.md:123 curl -s -X GET "https://app.rightbrain.ai/api/v1/org" \Cursor Plugin (Plugin)
Compatibility: Not stated.
Cursor plugin for managing Rightbrain AI tasks , browse, run, create, update, and export task configurations directly from your editor.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:30 prepareCursor Usage (Plugin)
Compatibility: Portable across standard formats.
Ask your AI agent about your team's Cursor spending.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:30 prepareCursor Usage Plugin (Plugin)
Compatibility: Not stated.
MCP server and Cursor plugin for querying Cursor Enterprise usage, spending, and analytics.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/container-debugging/SKILL.md:111 wget -qO- http://db:5432 || echo "connection refused or timeout"Docker Developer Tools (Plugin)
Compatibility: Not stated.
Cursor IDE plugin for Docker workflows.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
skills/groketective/scripts/import_recovered.py:435 out = subprocess.run(cmd, capture_output=True, text=True,groketective (Plugin)
Compatibility: Not stated.
Cursor plugin: Groketective , Grok Bot (sand) forensics and recovered-transcript import.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
packages/cli/bench/scan.bench.mjs:108 fs.rmSync(root, { recursive: true, force: true });Harness Score (Plugin)
Compatibility: Portable across standard formats.
Your AI coding agent is only as reliable as the harness around it.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL
mcp-server/src/tools/adguardFilters.ts:30 `curl -sf ${auth} 'http://localhost:${port}/control/filtering/statusHome Lab Developer Tools (Plugin)
Compatibility: Not stated.
Home lab and Raspberry Pi workflows for Cursor, Claude Code, and MCP-compatible editors - 22 skills, 11 rules, and 50 MCP tools for Docker Compose, monitoring, DNS, networking, backups, security, logs, notifications, OS management, certificates, multi-node, diagnostics, and SSH a
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
plugins/kernel-development-skills/skills/kernel-development-skills/scripts/check_kernel_api_patterns.py:361 reKernel Development Skills (Plugin)
Compatibility: Not stated.
Kernel Field Guide: an Agent Skill and plugin that gives coding agents the working habits of experienced Linux kernel engineers
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
scripts/check-public-files.py:9 paths = subprocess.check_output(Leadmagic Cursor Plugin (Plugin)
Compatibility: Not stated.
LeadMagic Cursor plugin for B2B research, email finding, company intelligence, and data enrichment through hosted MCP with OAuth.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
server.py:40 proc = subprocess.run(Mcp Ytdlp Transcript (Plugin)
Compatibility: Not stated.
Youtube Transcript MCP server.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
app/config.py:272 os.remove(self.cache_file)Model Maestro (Plugin)
Compatibility: Not stated.
Unified LLM Gateway that proxies multiple providers (Ollama, OpenAI-compatible) behind a single API.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
scripts/validate.py:150 tracked = subprocess.run(Monologue Plugin (Plugin)
Compatibility: Not stated.
Official Monologue plugin for Codex, Claude Code, Cursor, Gemini CLI, and Agent Plugins clients
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
norman_mcp/files/download.py:96 shutil.rmtree(temp_dir, ignore_errors=True)Norman Mcp Server (Plugin)
Compatibility: Portable across standard formats.
AI-powered bookkeeping and tax filing automation for entrepreneurs at the heart of the European economy
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:20 postinstallproctor (Plugin)
Compatibility: Not stated.
Catch AI agents gaming their test suites
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:10 preparePrompthaus Recruiting (Plugin)
Compatibility: Not stated.
Search quiz-backed Skills Wallets across 16+ career pathways.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
rules/fastapi-anti-patterns.mdc:142 - `subprocess.run()` - use `asyncio.create_subprocess_exec()`Roninforge Fastapi (Plugin)
Compatibility: Not stated.
Cursor plugin for FastAPI + Pydantic v2.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
rules/terraform-core.mdc:282 The provider picks up credentials from `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KRoninforge Terraform (Plugin)
Compatibility: Not stated.
Cursor plugin for Terraform 1.9+ and OpenTofu 1.8+.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:13 postinstallsemaphore (Plugin)
Compatibility: Not stated.
AI Agent status indicator for your desk
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/smoke-mcp.mjs:25 const challengeResponse = await fetch(endpoint, {Sideshift Mcp Server (Plugin)
Compatibility: Not stated.
Official Cursor plugin for SideShift's hosted MCP server.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zbHDdg8N0" style="display:none">ZytLQlx9R33fPp5XKofDnJh3HP8n7/87cFC168Jp2R1RNkdIXm0AB4ZzSkill Shipyard Pipeline (Plugin)
Compatibility: Not stated.
Skill Package 2026: Ultimate AI Skills Deployment Tool , Plugin, ZIP & CI/CD
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
.github/scripts/check_versions.py:106 result = subprocess.run(Skills Marketplace (Plugin)
Compatibility: Not stated.
Centrale catalogus van AI-assistant plugins voor de Nederlandse Overheid
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/c2pa_sign.py:310 shutil.rmtree(dev_tmpdir, ignore_errors=True)socialforge (Plugin)
Compatibility: Portable across standard formats.
An open-source social media production system that turns a content calendar into on-brand copy, images, video, and client-ready delivery - with compliance and human approval built in.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
demo-v5.mjs:18 fs.rmSync(root + "/.speclock", { recursive: true, force: true });speclock (Plugin)
Compatibility: Portable across standard formats.
Action guardrails for AI coding agents , native Claude Code enforcement, MCP integrations, and Git/CI checks.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
README.md:156 - **Configuration**: Set `OPENAI_API_KEY` environment variable or use the profile's `.env` fileStructify Dev Flow (Plugin)
Compatibility: Not stated.
Plan Build Run 2026: Ultimate Claude Code Plugin for Structured Agent Development
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zkaS7KXO0" style="display:none">ZCw/B+wFlX4pdxsjd/wjdzeG7rbFdEtXKGk0X7TAqxpSMTMN7hXSBHA6Supremeworkflow Orchestrator (Plugin)
Compatibility: Not stated.
Superpowers Security Ops 2026: OWASP Workflow Routing & Auto-Fix Red Team Engine
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zvKVmvFT0" style="display:none">qMDdGf2mhPegycIRN0NV02u/8NOs4PGaOzkJ9riy4VGe3dET/7bDjfmESwift Uikit Components (Plugin)
Compatibility: Not stated.
Swift-UIKit-Pro 2026: Build Production-Ready Programmatic iOS Apps with Advanced Architecture & Data Flow Patterns
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zQB0A24s0" style="display:none">HwLt9Vgkj2XEXuFdegvLkNkjzLY9fGMrWvoxEb3Bw48pH+H/WjTIH50TUikit Mastery Playbook (Plugin)
Compatibility: Not stated.
UIKit Expert Skill 2026 - Best Practices & High Performance Swift Code
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_UNCONFIRMED +1 more
src/index.ts:284 async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {vouched (Plugin)
Compatibility: Not stated.
Connect Claude, Cursor, or any MCP client to 18 SEO tools.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:44 postinstallwizard (Plugin)
Compatibility: Not stated.
Build AI spells for what you do - a meta-builder that turns recurring tasks into reusable workflows that any AI assistant can run.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
infra/onprem/deploy-onprem.sh:158 curl -fsSL https://ollama.com/install.sh | shagentsmcp (Plugin)
Compatibility: Not stated.
Context-sync protocol for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
plugins/ai-marketplace/src/dashboardCli.ts:73 const response = await fetch(`${descriptor.origin}/api/control/sAi Marketplace (Plugin)
Compatibility: Not stated.
Cross tools (Codex, Claude, Github Copilot, Cursor) AI Marketplace to install skills, agents, MCPs, hooks, commands, and rules.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
src/backend/actions.ts:325 const response = await fetch(url, init)AirSQLite (Plugin)
Compatibility: Not stated.
a cheap (free) imitation of Airtable's data layer for SQLite databases in VSCode + Cursor
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
install.sh:16 # curl -fsSL https://raw.githubusercontent.com/borenstejn/formloop/main/install.sh | bashformloop (Plugin)
Compatibility: Not stated.
Generate rich UI forms on-the-fly from LLM agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
skills/native-install/SKILL.md:19 curl -sSL https://get.mobazha.org/install | bashMobazha Skills (Plugin)
Compatibility: Not stated.
AI skills for Mobazha decentralized commerce: store deployment, product import, privacy tools
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
README.md:89 curl -fsSL https://sthenosec.com/download/plugins/install.sh | bash -s -- --agent cursorReachable Agent Plugin Installer (Plugin)
Compatibility: Not stated.
Claude Code marketplace for the REACHABLE plugin (generated from the signed adapter).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
skill-packager-workspace/iteration-1/eval-1-universal-repo/without_skill/outputs/proof-engine-skill/skill/scriSkill Packager Skill (Plugin)
Compatibility: Not stated.
Package AI agent skills into deployment formats , .zip, .skill, Claude plugin, Claude marketplace, Cursor plugin, Cursor marketplace, native Codex/ChatGPT plugin, ChatGPT/Manus zip, Codex CLI, NanoClaw marketplace, OpenClaw/ClawHub, Agent Skills standard (.agents/), or a univers
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
examples/workflows/soliton-review-tiered.yml:51 curl -sSfL https://raw.githubusercontent.com/gitleaks/gitleakssoliton (Plugin)
Compatibility: Not stated.
Risk-adaptive multi-agent PR review for Claude Code & Cursor , 7 specialized agents catch bugs, security flaws, and AI hallucinations in parallel
This grade is a hygiene screen, not proof of safety.
