reproduce-and-fix-issues
An agent skill by cursor, from cursor/plugins. Tags: automation, debugging, testing, troubleshooting, validation.
What it does
Reproduce triaged Slack bugs through a configured app-control adapter, verify existing fixes, and open a bounded draft pull request only after before-and-after proof. Use only from the configured Benny repro automation.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add cursor/plugins --skill reproduce-and-fix-issuesOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/cursor/plugins
cp -r plugins/pstack/automations/benny/skills/reproduce-and-fix-issues ~/.claude/skills/reproduce-and-fix-issuesSafety box score
Grade D, elevated risk: 53 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This is an end-to-end bug repro/fix automation skill: it drives a real app via a control adapter, posts Slack status and source-thread updates, and can optionally edit code and open a draft GitHub PR after before/after proof. The main risks are external communication, credential handling (Slack token), and modifying repository state plus disposable profiles/artifacts.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 2 (moderate) | It can drive a real app through a control adapter and may delegate a code worker to edit and run required checks ('A tightly scoped code edit may be delegated' / 'The coordinator reviews the edit and runs or verifies the required tests'), but it does not ship a native script or `eval` payload. |
| Network access | 2 (moderate) | It posts to Slack and links GitHub/tracker URLs ('The coordinator is the only Slack poster', 'Use github.com pull request links', 'Link the tracker issue'), but the network use is bounded to those services. |
| Filesystem reach | 2 (moderate) | It can create and clean up captures, recordings, temp profiles, workspaces, and repository edits ('Keep captures, recordings, logs, and tokens out of source control', 'remove disposable: Browser or app profiles... temporary workspaces'), which reaches beyond read-only access. |
| Secrets & credentials | 2 (moderate) | It explicitly handles `BENNY_SLACK_BOT_TOKEN` and warns never to expose Slack tokens to workers, so it may touch credentials even though it tries to keep them contained. |
| Privilege & persistence | 1 (low) | There is no sudo or system-service install, but it does coordinate repo workflows, commits, and cleanup of app profiles/sessions, which is a small but nonzero privilege footprint. |
| Instruction hijack surface | 1 (low) | It consumes external source-thread and tracker content ('Read the full source thread and tracker issue when present') and external configuration, but it does not tell the agent to follow arbitrary fetched instructions or hide them. |
| Irreversible actions | 3 (high) | It can post Slack replies, open draft pull requests, and attempt fixes after a repro ('Open a draft pull request', 'post one concise reply in the operations thread'), which are externally visible actions with code changes. |
| Transparency | 0 (none) | The skill files are plain markdown with no binaries, base64 blobs, or downloaded installers; the only missing pieces are external config and adapter implementations, not opaque content. |
Before installing
- Read `SKILL.md` with the Slack and PR actions in mind; it can post messages and open draft PRs.
- Confirm the configured control adapter and feature map really exist for your app before enabling it.
- Use disposable Slack/GitHub credentials and a scratch workspace first; it references `BENNY_SLACK_BOT_TOKEN` and creates recordings/captures.
- Verify the adapter cleanup path only removes disposable profiles/workspaces and not your normal browser or app data.
Rated 2026-10-16 by an automated review of 4 files from the skill's repository.
Source
- Repository
- cursor/plugins (all skills from this repository)
- Path
- pstack/automations/benny/skills/reproduce-and-fix-issues/SKILL.md
- Branch
- main
- Collection
- cursor
- Updated
- 2026-09-23
Related skills
- control-cli — Build or adapt a local harness to drive, inspect, and profile an interactive CLI or TUI without external services.
- control-ui — Build or adapt a local browser/CDP harness to drive and inspect a web, IDE, or Electron UI.
- E2E Testing Nori Skillsets Subcommands — Use when you need to interactively test a nori-skillsets CLI subcommand end-to-end via tmux, with full filesystem isolation
- TUI Puppeteering with tmux — Use when automating or testing TUI/CLI applications - provides isolated tmux sessions with scripts for input, output capture, and state verification
- blast-radius — Find what a change could break somewhere else before it ships, beyond the diff.
- check-compiler-errors — Run compile and type-check commands and report failures