CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · skills/onesignal-setup/SKILL.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptskills/onesignal-setup/SKILL.md· markdown

21## Authentication Guidance

23Tell users to follow Cursor's OAuth prompt for the OneSignal MCP server. Never ask users to

… (107 chars elided on L23)

25If Cursor was already open when the plugin was installed or updated, ask the user to reload

… (63 chars elided on L25)

Occurrences

1 occurrence · at L23

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha2565084aa178cfd9d97…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/onesignal-setup/SKILL.md · 1 file

skills/onesignal-setup/SKILL.md2.2 KB · Markdown

name: onesignal-setup

description: Use this skill when the user wants to install, configure, authenticate, test, or troubleshoot the OneSignal Cursor plugin or OneSignal MCP server. Triggers on "set up OneSignal in Cursor", "configure the OneSignal MCP", "how do I connect Cursor to OneSignal", or any first-run plugin setup question.

OneSignal Cursor Plugin Setup

Purpose

Help the user connect Cursor to OneSignal through the hosted OneSignal MCP server.

This plugin uses OAuth through the hosted OneSignal MCP server.

Required Setup

The user needs:

Cursor with plugin support.
A OneSignal account.

Authentication Guidance

Tell users to follow Cursor's OAuth prompt for the OneSignal MCP server. Never ask users to paste OAuth tokens, API keys, private keys, or credentials into chat, source files, rules, skills, commits, screenshots, or issue reports.

If Cursor was already open when the plugin was installed or updated, ask the user to reload Cursor with Developer: Reload Window or fully restart Cursor.

First Test

Use a read-only or utility MCP tool first. Prefer:

onesignal_health
onesignal_config
onesignal_reference_overview

Do not start with message sends, segment updates, template updates, Journey creation, exports, or subscription transfers.

Troubleshooting

If tools do not appear:

Confirm the plugin is installed or symlinked into ~/.cursor/plugins/local/onesignal.
Confirm .cursor-plugin/plugin.json is at the plugin root.
Confirm mcp.json has a top-level mcpServers object.
Reload Cursor.
Check Cursor's MCP logs from the Output panel.

If tools appear but calls fail:

Confirm the user completed the OneSignal OAuth flow in Cursor.
Confirm the account has access to OneSignal MCP.
Check whether the server URL is https://api.onesignal.com/mcp/oauth.
Retry with a read-only utility tool.

Safety Defaults

For any write or send operation:

Prefer test users and narrow test audiences.
Summarize audience, content, timing, and expected effect.
Require explicit user approval before running the tool.
Add an extra confirmation for large audiences, production sends, deletes, or irreversible operations.

onesignal-setup— agent skill

Is onesignal-setup safe to install?

OneSignal Cursor Plugin Setup

Purpose

Required Setup

Authentication Guidance

First Test

Troubleshooting

Safety Defaults

Audit the pieces. Scan the whole. Decide.