cursor-edit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cursor-edit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill outsources only the act of editing files to Cursor's headless CLI (cursor-agent). Use the same contract from Claude Code, Codex, or any other AI agent.
The goal is to move heavy editing work to Cursor, reducing token usage in the calling AI agent and speeding up the overall task.
This only pays off for larger edits. For small changes, the cost of writing self-contained instructions and reviewing git diff can exceed the cost of direct editing. Do not force this skill onto trivial one-line or few-line edits.
These tendencies apply:
cursor-agent can closely follow good sibling examples and often produce convention-compliant results quickly.cursor-agent tends to pattern-match without semantic validation, so correctness is not guaranteed. In this case, the calling AI agent must separately verify semantic correctness. See "Required Verification".Edit, Write, or apply_patch.scripts/cursor-agent-print.sh, which calls cursor-agent.cursor-agent-print.sh so cursor-agent edits the files.git diff, then build/test/lint the changed scope.Call the wrapper from the target repository root. If working in a worktree, run it from the worktree root. cursor-agent reads and writes files relative to the current directory.
<cursor-edit>/scripts/cursor-agent-print.sh "<edit instructions>"<cursor-edit> is the directory where this skill is installed.
Internally, the wrapper runs:
cursor-agent -p --force --trust --output-format text --model "${CURSOR_MODEL:-composer-2.5-fast}" "<edit instructions>"
# -p : non-interactive print mode
# --force : apply file changes without confirmation
# --trust : trust the workspace without promptingThe default model is Composer2.5 Fast (composer-2.5-fast). Set CURSOR_MODEL to override it.
CURSOR_MODEL=gpt-5.5 <cursor-edit>/scripts/cursor-agent-print.sh "<edit instructions>"cursor-agent is another AI. If instructions are vague, Cursor can edit in the wrong direction. Write instructions that are self-contained.
foo-1.test.ts through foo-6.test.ts files and follow their conventions." This is the strongest lever for quality and convention matching. cursor-agent follows imports, naming, helpers, and local patterns much better when it has good examples.Good instruction example:
In server/src/domain/foo/foo.ts, add an early return at the start of Foo.validate()
that returns new EmptyNameError() when this.name.trim() === "".
Do not change the existing logic.
Do not edit any files other than the specified file.cursor-agent roam freely. Always name the files it is allowed to edit and keep it out of unrelated scope.cursor-agent-print.sh from the worktree root and include "do not modify files outside this worktree" in the instructions.cursor-agent alone.cursor-agent runs from the current working directory, verify that worktree edits stayed inside the worktree and did not dirty the parent repository, for example with git -C <worktree> status.git diff and builds do not prove the semantic correctness of claims or logic. For new or non-obvious logic, such as whether an assertion is really valid or whether an API actually exists, the calling AI agent must verify the behavior against use cases and sibling tests. Be especially careful when there is no good sibling example. Confirm with search before claiming that something is absent or nonexistent.cursor-agent is missing or authentication fails, report that the execution environment does not meet the prerequisite and stop.cursor-agent fails or edits against the instructions, make the instructions more specific and retry.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.