cursor-sdk

An agent skill by cursor, from cursor/plugins. Tags: api, automation, development, sdk, typescript.

What it does

Guide users building apps, scripts, CI pipelines, or automations on top of the Cursor TypeScript SDK (`@cursor/sdk`). Use this skill whenever the user mentions integrating, installing, or writing code against the Cursor SDK; whenever they say `Agent.create`, `Agent.prompt`, `Agent.resume`, `agent.send`, `run.stream`, `CursorAgentError`, or `@cursor/sdk`; whenever they ask to run Cursor agents programmatically from a script, CI/CD pipeline, GitHub Action, backend service, or any other code that isn't the Cursor IDE itself; and whenever they want to pick between local and cloud runtime, configure MCP servers for an SDK agent, or handle streaming, cancellation, or errors from an SDK agent. Also trigger when a user is wiring Cursor into an automation, writing a bot that runs Cursor, or porting REST `/v1/agents` calls to the SDK, even if they don't explicitly name the package. Use this eagerly rather than answering from memory; the SDK surface evolves and this skill plus its references are the source of truth for the external package.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add cursor/plugins --skill cursor-sdk

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/cursor/plugins
cp -r plugins/cursor-sdk/skills/cursor-sdk ~/.claude/skills/cursor-sdk

Safety box score

Grade C, moderate risk: 39 of 100 risk points, rated 2026-09-23. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a documentation-heavy guide for building integrations on top of the Cursor TypeScript SDK, not a bundled executable. Its main blast radius comes from code it helps you write: local agents can act on the caller’s checkout and environment, cloud agents can clone repos and open PRs, and MCP config can move secrets and data to third-party services.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	The skill ships no binaries or scripts, but it points users at `Agent.prompt/create/send` flows and stdio MCP subprocesses (`command: "npx"`), which can execute tools on the caller’s machine or in a cloud VM.
Network access	2 (moderate)	It explicitly clones GitHub repos into cloud VMs and talks to remote Cursor/MCP services (`repos[].url`, HTTP MCP `headers`/`auth`), so prompts, repo content, and tokens can leave the machine.
Filesystem reach	2 (moderate)	Local runs operate on the caller’s `cwd`, and the docs warn to treat them like `rm -rf`; if `cloud:` is omitted the SDK silently defaults to local.
Secrets & credentials	2 (moderate)	The docs center on `CURSOR_API_KEY`, `.env`, `GITHUB_TOKEN`, `LINEAR_API_KEY`, and injected MCP `env`/`Authorization` headers, so the skill routinely handles sensitive credentials.
Privilege & persistence	0 (none)	No sudo, global installs, services, shell-startup edits, or other OS-level privilege changes are described.
Instruction hijack surface	0 (none)	I found no hidden prompt-injection payloads or instructions to ignore confirmations; the “source of truth” language is ordinary documentation guidance.
Irreversible actions	3 (high)	Cloud patterns can auto-create PRs, post review comments, triage tickets, resume agents, and delete/archive agent state (`autoCreatePR: true`, `skipReviewerRequest: true`, `Agent.delete(...)`), so unattended remote actions are a core capability.
Transparency	0 (none)	All files are plain Markdown; there are no binaries, minified blobs, or runtime-decoded content.

Before installing

Decide up front whether you want `local:` or `cloud:`; make the choice explicit in code so it does not silently fall back to local.
Read `references/mcp.md` before wiring any MCP server, especially the parts about cloud `env` injection and HTTP header proxying.
Check every secret path (`CURSOR_API_KEY`, `GITHUB_TOKEN`, `.env`) and make sure it will not be logged or exposed to child processes.
Test in a scratch repo or branch first, then verify the agent only touches the intended `cwd` and does not open PRs unless you want that.

Rated 2026-09-23 by an automated review of 8 files from the skill's repository.

Source

Repository: cursor/plugins (all skills from this repository)
Path: cursor-sdk/skills/cursor-sdk/SKILL.md
Branch: main
Collection: cursor
Updated: 2026-09-23

expo-module — Framework (OSS). Guide for creating and writing Expo native modules and views using the Expo Modules API (Swift, Kotlin, TypeScript).
principle-migrate-callers-then-delete-legacy-apis — Apply when introducing a new internal API while old callers still exist.
principle-type-system-discipline — Apply when designing types, reviewing a function signature, or writing code in any statically-typed language.
ralph-loop — Start a Ralph Loop for iterative self-referential development.
typescript-best-practices — TypeScript best practices. Use when reading or editing any .ts or .tsx file.
agents-connect — Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies.