cubic-353a14 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cubic-353a14 (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Access cubic's AI code review insights directly from Claude Code. Get PR review issues, browse AI-generated wikis, check codebase scans, and apply team review learnings — all without leaving your editor.
/plugin marketplace add mrge-io/skills
/plugin install cubic@cubicRequires Claude Code v1.0.33+
# All targets (default)
npx @cubic-plugin/cubic-plugin install
# Claude Code
npx @cubic-plugin/cubic-plugin install --to claude
# OpenCode
npx @cubic-plugin/cubic-plugin install --to opencode
# Codex
npx @cubic-plugin/cubic-plugin install --to codex
# Cursor
npx @cubic-plugin/cubic-plugin install --to cursor
# Factory Droid
npx @cubic-plugin/cubic-plugin install --to droid
# Pi
npx @cubic-plugin/cubic-plugin install --to pi
# Gemini CLI
npx @cubic-plugin/cubic-plugin install --to gemini
# Universal (.agents/skills)
npx @cubic-plugin/cubic-plugin install --to universalBy default, installs go to the user's home directory under ~ using each tool's standard config location. If a target is already installed, the installer skips it; use --force to reinstall.
The installer writes OAuth-ready MCP configuration. It does not ask for a cubic API key. After installing, use your coding tool's MCP login flow to authenticate cubic.
To uninstall, use the same --to flag:
npx @cubic-plugin/cubic-plugin uninstall --to opencode/cubic:run-review# Step 1: Add the cubic marketplace
/plugin marketplace add mrge-io/skills
# Step 2: Install the plugin
/plugin install cubic@cubicRequires Claude Code v1.0.33+
To make cubic automatically available for all team members in a repository, add this to your project's .claude/settings.json:
{
"extraKnownMarketplaces": {
"cubic": {
"source": {
"source": "github",
"repo": "mrge-io/skills"
}
}
},
"enabledPlugins": {
"cubic@cubic": true
}
}When team members open the project in Claude Code and trust the repository, they'll be prompted to install the plugin.
The installer writes cubic's MCP server URL into each supported tool:
https://www.cubic.dev/api/mcpUse OAuth to authenticate from the tool after install:
/mcp, choose cubic, and complete the browser flow.cursor-agent mcp login cubic.codex mcp login cubic./mcp auth cubic.opencode mcp auth cubic./mcp, choose cubic, and complete the browser flow./mcp-auth cubic.When using JSON mode (--json) from another CLI wrapper, installation is non-interactive and emits NDJSON progress events:
npx -y @cubic-plugin/cubic-plugin install --json --method symlinkNo API key is required for JSON mode; users authenticate later through their MCP client.
| Command | Description |
|---|---|
/cubic:comments [pr-number] | Show cubic's review comments on the current PR (auto-detects branch) |
/cubic:run-review [flags] | Run a local cubic AI code review on uncommitted changes or branch diff |
/cubic:wiki [page-name] | Browse AI-generated codebase documentation |
/cubic:scan [scan-id] | View codebase security scan results and issues |
/cubic:learnings [learning-id] | Show team code review patterns and preferences |
These activate automatically based on what you're doing:
| Skill | Triggers when | What it does |
|---|---|---|
| check-pr-comments | "Check all PR comments", PR comments/issues, fixing review feedback | Fetches unresolved cubic PR comments, fixes worthwhile issues, commits/pushes, and resolves handled threads |
| run-review | "Review my code", pre-commit/PR quality checks | Runs a local cubic AI code review via CLI and surfaces issues |
| cubic-loop | "Loop until clean", polishing before merge | Iteratively reviews, fixes, and re-reviews until clean |
| codebase-context | Asking about architecture or how things work | Queries the cubic AI Wiki for architectural context |
| review-patterns | Writing or reviewing code | Pulls team learnings to apply coding conventions |
The plugin connects to cubic's MCP server, giving Claude access to 9 tools:
Wiki: list_wikis, list_wiki_pages, get_wiki_page Codebase Scans: list_scans, get_scan, get_issue Review Learnings: list_learnings, get_learning PR Reviews: get_pr_issues
skills/
├── .claude-plugin/
│ ├── marketplace.json # Marketplace catalog for distribution
│ └── plugin.json # Plugin metadata
├── .mcp.json # cubic MCP server configuration
├── commands/
│ ├── comments.md # /cubic:comments command
│ ├── run-review.md # /cubic:run-review command (CLI)
│ ├── wiki.md # /cubic:wiki command
│ ├── scan.md # /cubic:scan command
│ └── learnings.md # /cubic:learnings command
├── skills/
│ ├── check-pr-comments/ # Fetches, investigates, and triages PR review comments
│ │ └── SKILL.md
│ ├── run-review/ # Runs local AI code review via cubic CLI
│ │ └── SKILL.md
│ ├── cubic-loop/ # Iteratively reviews, fixes, and re-reviews until clean
│ │ └── SKILL.md
│ ├── codebase-context/ # Auto-queries wiki for architecture context
│ │ └── SKILL.md
│ └── review-patterns/ # Auto-applies team review learnings
│ └── SKILL.md
└── README.mdMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.