CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · skills/onesignal-setup/SKILL.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptskills/onesignal-setup/SKILL.md· markdown

35```

37Use a test app or least-privilege key first. Never ask users to paste API keys into chat, so

… (66 chars elided on L37)

39If Cursor was already open when the variable was set, ask the user to reload Cursor with `De

… (48 chars elided on L39)

Occurrences

1 occurrence · at L37

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha2565084aa178cfd9d97…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/onesignal-setup/SKILL.md · 1 file

skills/onesignal-setup/SKILL.md2.6 KB · Markdown

name: onesignal-setup

description: Use this skill when the user wants to install, configure, authenticate, test, or troubleshoot the OneSignal Cursor plugin or OneSignal MCP server. Triggers on "set up OneSignal in Cursor", "configure the OneSignal MCP", "ONESIGNAL_REST_API_KEY", "MCP server failed", "how do I connect Cursor to OneSignal", or any first-run plugin setup question.

OneSignal Cursor Plugin Setup

Purpose

Help the user connect Cursor to OneSignal through the hosted OneSignal MCP server.

This plugin currently uses OneSignal REST API key authentication. OAuth support can be added later after the hosted OAuth MCP flow is verified end to end in Cursor.

Required Setup

The user needs:

Cursor with plugin support.
A OneSignal app.
A OneSignal REST API key for that app.
The ONESIGNAL_REST_API_KEY environment variable available to Cursor.

The plugin MCP config sends the key as an api_key header to:

https://mcp.onesignal.com/mcp

Authentication Guidance

Tell users to set the environment variable before opening Cursor:

export ONESIGNAL_REST_API_KEY=replace-with-your-rest-api-key

Use a test app or least-privilege key first. Never ask users to paste API keys into chat, source files, rules, skills, commits, screenshots, or issue reports.

If Cursor was already open when the variable was set, ask the user to reload Cursor with Developer: Reload Window or fully restart Cursor.

First Test

Use a read-only or utility MCP tool first. Prefer:

onesignal_health
onesignal_config
onesignal_reference_overview
list_segments with a known test app id

Do not start with message sends, segment updates, template updates, Journey creation, exports, or subscription transfers.

Troubleshooting

If tools do not appear:

Confirm the plugin is installed or symlinked into ~/.cursor/plugins/local/onesignal.
Confirm .cursor-plugin/plugin.json is at the plugin root.
Confirm mcp.json has a top-level mcpServers object.
Reload Cursor.
Check Cursor's MCP logs from the Output panel.

If tools appear but calls fail:

Confirm ONESIGNAL_REST_API_KEY exists in Cursor's environment.
Confirm the key is for the app being queried.
Confirm the app has MCP access enabled if feature flags are used.
Retry with a read-only utility tool.

Safety Defaults

For any write or send operation:

Prefer test apps and test users.
Summarize app id, audience, content, timing, and expected effect.
Require explicit user approval before running the tool.
Add an extra confirmation for large audiences, production apps, deletes, or irreversible operations.

onesignal-setup— agent skill

Is onesignal-setup safe to install?

OneSignal Cursor Plugin Setup

Purpose

Required Setup

Authentication Guidance

First Test

Troubleshooting

Safety Defaults

Audit the pieces. Scan the whole. Decide.