The Agent Skills Directory

================================================================================

✅ VERDICT: SAFE

This skill is a set of instructions in markdown format designed to guide a user through setting up a development environment. It outlines steps for installing core development tools, setting up a repository, configuring environment variables, and configuring the Cursor IDE with Multi-Context Providers (MCPs).

Total Findings: 1

🔵 LOW Findings: • Sensitive Configuration

Line 59: The skill instructs the user to manually edit ~/.cursor/mcp.json and .env files with sensitive tokens (e.g., YOUR_NOTION_TOKEN, YOUR_N8N_TOKEN). While the skill itself does not exfiltrate these tokens, it highlights the user's responsibility for secure handling of these credentials during configuration. This is a best practice consideration rather than a direct vulnerability introduced by the skill.

ℹ️ TRUSTED SOURCE References: • External Dependency (npm install)

Line 20: The skill instructs the user to run npm install. This command downloads packages from the npm registry, which is a trusted source for software packages. This finding is downgraded to INFO due to the trusted source. • External Dependency (npx @notionhq/notion-mcp-server)
Line 65: The mcp.json template includes a command to execute npx @notionhq/notion-mcp-server. This downloads and runs a package from the npm registry, a trusted source. This finding is downgraded to INFO due to the trusted source. • External Dependency (npx supergateway)
Line 71: The mcp.json template includes a command to execute npx supergateway. This downloads and runs a package from the npm registry, a trusted source. This finding is downgraded to INFO due to the trusted source. • External Dependency (npx @upstash/context7-mcp@latest)
Line 76: The mcp.json template includes a command to execute npx @upstash/context7-mcp@latest. This downloads and runs a package from the npm registry, a trusted source. This finding is downgraded to INFO due to the trusted source. • External Download (Figma Desktop App)
Line 11: The skill provides a direct download link for the Figma Desktop App (https://www.figma.com/downloads/). Figma is a well-known, trusted software provider. This finding is downgraded to INFO due to the trusted source. • External Reference (Design Resources)
Lines 36-38: The skill references external design resource websites (https://mobbin.com/, https://pageflows.com/, https://www.refactoringui.com/). These are informational links and do not involve active downloads or execution. These are considered trusted external references. • External Reference (JSON Validator)
Line 129: The skill suggests using jsonlint.com for JSON validation. This is an external reference to a common, trusted utility. This finding is downgraded to INFO due to the trusted source.

No prompt injection, data exfiltration, obfuscation, privilege escalation, persistence mechanisms, metadata poisoning, indirect prompt injection, or time-delayed/conditional attacks were detected.

================================================================================

setup