thermo-nuclear-review
An agent skill by cursor, from cursor/plugins. Tags: code-review, debugging, review, security, validation.
What it does
Comprehensive security and correctness audit of a branch's changes. Use for thermo nuclear, thermonuclear, or deep review requests, or branch/PR diff audits focused on bugs, breaking changes, security issues, devex regressions, and feature-gate leaks.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add cursor/plugins --skill thermo-nuclear-reviewOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/cursor/plugins
cp -r plugins/thermos/skills/thermo-nuclear-review ~/.claude/skills/thermo-nuclear-reviewSafety box score
Grade B, low risk: 12 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This is a plain-text review prompt for auditing the checked-out branch; it does not ship any executable scripts or make changes itself. The only notable exposure is that it may query remote PR/MR discussion with `gh`/`glab`, which uses the caller’s authenticated account.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 0 (none) | No bundled scripts or code execution are present; the file is only Markdown instructions. |
| Network access | 1 (low) | It explicitly says to check PR/MR discussion using `gh/glab cli`, which can contact remote GitHub/GitLab APIs. |
| Filesystem reach | 1 (low) | The skill is scoped to a "checked out branch" and its diff, so it reads local repo contents but does not mention writing outside the workspace. |
| Secrets & credentials | 1 (low) | Using `gh`/`glab` for discussion lookup will run under the user’s existing CLI login/token, but the skill does not ask to reveal secrets. |
| Privilege & persistence | 0 (none) | There is no request for sudo, global installs, services, scheduled tasks, or OS/shell configuration changes. |
| Instruction hijack surface | 0 (none) | The text is review guidance only; it does not tell the agent to ignore safeguards, follow hidden remote instructions, or conceal actions. |
| Irreversible actions | 0 (none) | It only audits and reports findings; it does not merge, deploy, send messages, or modify data. |
| Transparency | 0 (none) | The skill is plain Markdown with no binaries, embedded blobs, minified code, or downloaded installers. |
Before installing
- Confirm you’re comfortable with the agent querying GitHub/GitLab discussion through `gh`/`glab`.
- If you want strict local-only review, use an environment without outbound network access or without `gh`/`glab` auth configured.
- Prefer a least-privileged GitHub/GitLab account for the review session.
Rated 2026-10-16 by an automated review of 1 file from the skill's repository.
Source
- Repository
- cursor/plugins (all skills from this repository)
- Path
- thermos/skills/thermo-nuclear-review/SKILL.md
- Branch
- main
- Collection
- cursor
- Updated
- 2026-09-23
Related skills
- interrogate — Use for "interrogate", "adversarial review", "multi-model review", "challenge this", "stress test this code", "find blind spots", or "tear this apart".
- no-comments — Spawn Comment Sicko, fix accepted findings, and offer encodings for claimed constraints.
- thermo-nuclear-code-quality-review — Run an extremely strict maintainability review for abstraction quality, giant files, and spaghetti-condition growth.
- thermos — Launch both thermo-nuclear review subagents in parallel, then synthesize their findings.
- diff-scanning-with-aws-security-agent — Run a fast AWS Security Agent diff scan on only the changed code since a git ref.
- differential-review — Performs security-focused differential review of code changes.