review-plugin-submission

An agent skill by cursor, from cursor/plugins. Tags: catalog, compliance, developer-tools, review, validation.

What it does

Audit a Cursor plugin for marketplace readiness. Use when validating manifests, component metadata, discovery paths, and submission quality before publishing.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add cursor/plugins --skill review-plugin-submission

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/cursor/plugins
cp -r plugins/create-plugin/skills/review-plugin-submission ~/.claude/skills/review-plugin-submission

Safety box score

Grade A, minimal risk: 0 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a read-only checklist for reviewing a Cursor plugin submission. It only inspects manifest, metadata, discoverability, and documentation files in the repository, so the main effect is limited to analysis and reporting rather than executing code or changing the machine.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	0 (none)	The skill only describes verification steps in markdown and contains no scripts, shell commands, or code evaluation.
Network access	0 (none)	It does not download data, call remote services, or send information off the machine.
Filesystem reach	0 (none)	The workflow is limited to checking repository paths such as `.cursor-plugin/plugin.json`, `skills/*/SKILL.md`, and `README.md`; it does not write or delete files.
Secrets & credentials	0 (none)	There is no request to access tokens, keys, passwords, `.env` files, or other credential stores.
Privilege & persistence	0 (none)	It does not request sudo, global installs, services, shell profile edits, or other privilege changes.
Instruction hijack surface	0 (none)	The file contains no prompt-injection cues such as instructions to ignore rules, skip confirmations, or fetch and follow remote content.
Irreversible actions	0 (none)	It only produces a pass/fail review and fix list; it does not publish, deploy, message, or otherwise act on the user's behalf.
Transparency	0 (none)	The provided source is plain markdown and fully readable; there are no binaries, installers, or decoded runtime payloads.

Before installing

No special machine or account checks are needed for this skill; it is documentation-only.
If you use it on a plugin repo, verify the referenced files exist and are readable, especially `.cursor-plugin/plugin.json` and `README.md`.
Confirm the review is being done on local repository files only, not on fetched or untrusted remote content.

Rated 2026-10-20 by an automated review of 1 file from the skill's repository.

Source

Repository: cursor/plugins (all skills from this repository)
Path: create-plugin/skills/review-plugin-submission/SKILL.md
Branch: main
Collection: cursor
Updated: 2026-09-23

check-agent-compatibility
cli-for-agents — Designs or reviews CLIs so coding agents can run them reliably: non-interactive flags, layered --help with examples, stdin/pipelines, fast actionable errors.
create-plugin-scaffold — Create a new Cursor plugin scaffold with a valid manifest, component directories, and marketplace wiring.
create-verification-skill — Generate a project-local verification skill that drives your app the way a user does — any language, framework, or platform.
maintain-verification-skill — Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature.
no-comments — Spawn Comment Sicko, fix accepted findings, and offer encodings for claimed constraints.