control-ui

An agent skill by cursor, from cursor/plugins. Tags: automation, debugging, testing, ui, validation.

What it does

Build or adapt a local browser/CDP harness to drive and inspect a web, IDE, or Electron UI. Use for local UI verification, screenshots, accessibility snapshots, perf profiles, visual diffs, or reproducing UI bugs.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add cursor/plugins --skill control-ui

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/cursor/plugins
cp -r plugins/cursor-team-kit/skills/control-ui ~/.claude/skills/control-ui

Safety box score

Grade B, low risk: 19 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is for driving a local browser/CDP UI harness to inspect apps, take screenshots, and collect logs/profiles. The main risks are that it executes browser automation against live UI state, can capture sensitive on-screen or network data, and writes artifacts like screenshots or traces to disk.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It uses browser automation code and tools such as `chromium.launch()` and `chromium.connectOverCDP(...)`, but only for local UI probing.
Network access	1 (low)	It connects to local app URLs and a localhost CDP port (`http://127.0.0.1:<port>`, `http://127.0.0.1:<debug-port>`), with optional network logging.
Filesystem reach	1 (low)	It writes artifacts such as screenshots to `/tmp/...` and may save traces or heap snapshots, but does not describe broad file access.
Secrets & credentials	1 (low)	The skill can capture screenshots, console logs, and network logs from an active browser session; it explicitly warns against storing artifacts from privacy-sensitive workspaces.
Privilege & persistence	0 (none)	No sudo, service registration, shell startup edits, or other privilege-escalating actions are described.
Instruction hijack surface	0 (none)	There is no instruction to ignore higher-level rules, follow remote content, or hide behavior.
Irreversible actions	1 (low)	It autonomously clicks, types, navigates, scrolls, and resizes a live UI to gather evidence, but it does not push, publish, pay, or message externally.
Transparency	0 (none)	The file is plain markdown with visible code snippets; there are no binaries, installers, or decoded blobs.

Before installing

Check whether the repo’s harness already exists and is limited to localhost before letting the agent run it.
Inspect whether the target app uses real accounts or sensitive data, since screenshots/logs can capture it.
Confirm where screenshots, traces, and heap snapshots are written so they do not linger in shared locations.
Run a first probe in a scratch profile and verify it only talks to `127.0.0.1`.

Rated 2026-10-20 by an automated review of 1 file from the skill's repository.

Source

Repository: cursor/plugins (all skills from this repository)
Path: cursor-team-kit/skills/control-ui/SKILL.md
Branch: main
Collection: cursor
Updated: 2026-09-23

control-cli — Build or adapt a local harness to drive, inspect, and profile an interactive CLI or TUI without external services.
reproduce-and-fix-issues — Reproduce triaged Slack bugs through a configured app-control adapter, verify existing fixes.
E2E Testing Nori Skillsets Subcommands — Use when you need to interactively test a nori-skillsets CLI subcommand end-to-end via tmux, with full filesystem isolation
TUI Puppeteering with tmux — Use when automating or testing TUI/CLI applications - provides isolated tmux sessions with scripts for input, output capture, and state verification
blast-radius — Find what a change could break somewhere else before it ships, beyond the diff.
check-compiler-errors — Run compile and type-check commands and report failures