review-and-ship

An agent skill by cursor, from cursor/plugins. Tags: delivery, development, github, review, testing.

What it does

Review the current branch for bugs, intent fit, and test coverage; run or write tests; commit focused work; open or update a PR.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add cursor/plugins --skill review-and-ship

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/cursor/plugins
cp -r plugins/cursor-team-kit/skills/review-and-ship ~/.claude/skills/review-and-ship

Safety box score

Grade C, moderate risk: 33 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a developer workflow helper: it reads the repo state, runs tests, commits changes, and pushes/opens a GitHub PR. The main risks are external network activity through `git`/`gh`, and the ability to publish changes from the local branch to a remote PR under the user’s authenticated GitHub account.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It directs the agent to run shell commands such as `git fetch origin main`, `git diff origin/main...HEAD`, `git status`, and `gh pr checks`, plus to run tests and commit changes.
Network access	2 (moderate)	It contacts remote services via `git fetch origin main`, `gh pr checks`, and later `Push branch and open or update a PR`, which sends repository data to GitHub.
Filesystem reach	2 (moderate)	The workflow includes making code changes, running tests, and `Commit selective files`, so it can write to the project tree and create local commits.
Secrets & credentials	1 (low)	It uses the authenticated GitHub CLI (`gh`) and Git remotes, so it will operate under the user’s logged-in account, but it does not explicitly read or request secrets.
Privilege & persistence	0 (none)	There is no mention of `sudo`, system-wide installs, services, shell startup files, or other privilege-changing operations.
Instruction hijack surface	0 (none)	The skill text does not tell the agent to ignore instructions, hide actions, or follow remotely fetched content.
Irreversible actions	2 (moderate)	It explicitly instructs the agent to `Push branch and open or update a PR`, which publishes work externally, though it is standard PR-based workflow rather than an irreversible deployment.
Transparency	0 (none)	The only shipped file is plain markdown; there are no binaries, base64 blobs, or opaque installers.

Before installing

Confirm you want a skill that can run git/gh commands and push to GitHub.
Check which GitHub account `gh` is logged into and what repository access it has.
Review whether you are comfortable with the agent making local edits and commits before asking again.

Rated 2026-10-20 by an automated review of 1 file from the skill's repository.

Source

Repository: cursor/plugins (all skills from this repository)
Path: cursor-team-kit/skills/review-and-ship/SKILL.md
Branch: main
Collection: cursor
Updated: 2026-09-23

github-review-pr — Reviews or re-reviews one contributor pull request—including an explicitly named closed PR being reconsidered—or a bounded newest-to-oldest sweep of all open.
deslop — Remove AI-generated code slop and clean up code style
get-pr-comments — Fetch and summarize review comments from the active pull request
maintain-verification-skill — Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature.
make-pr-easy-to-review — Prepare PRs for review by cleaning noisy history, improving PR descriptions, and adding reviewer guidance without changing code behavior.
new-branch-and-pr — Create a fresh branch, complete work, and open a pull request