Перевод: оболочка страницы на русском; тело навыка (SKILL.md) пока на английском — это исходные инструкции агента.

Cursor Review Bridge

Map Cursor Bugbot and Security Review to VibeOS.

Метаданные навыка

Источник	Встроенный (установлен по умолчанию)
Путь	skills/software-development/cursor-review-bridge
Версия	1.0.0
Автор	VibeOS
Лицензия	MIT
Платформы	linux, macos, windows
Теги	cursor, review, bugbot, security, code-review, verification
Связанные навыки	requesting-code-review, cursor-subagent-cookbook, github-code-review, pr-babysit, vibeos-local-verify-deploy

Справка: полный SKILL.md

к сведению

Ниже полное определение навыка, которое VibeOS загружает при активации. Это инструкции, которые видит агент.

Cursor Review Bridge

Cursor’s /review, /review-bugbot, and /review-security launch dedicated review subagents on a local/PR diff. VibeOS does not ship Cursor’s Bugbot binary — map the same intent onto independent verification skills and leaves.

When to Use

• User asks for Bugbot / security review / “как /review в Cursor”
• Before commit or Timeweb deploy when changes touch code
• After a multi-file feature when the implementer should not self-verify

Prerequisites

• Repo checkout with git (local remotes OK; GitHub optional)
• Skill requesting-code-review for the full pre-commit pipeline
• Optional: fleet critic profile / delegate_task leaf for fresh context
• Tests via scripts/run_tests.sh (never bare pytest for this tree)

How to Run

A. Bugbot-like (find bugs / regressions)

1. Scope the diff (do not invent findings without reading it):

git diff --stat
git diff          # or: git diff main...HEAD

2. Run skill requesting-code-review end-to-end (static scan → tests → independent reviewer → auto-fix loop).
3. For a fresh-context pass (true Bugbot feel), spawn a leaf:

delegate_task(
  goal="Independent code review of the current diff. Report bugs,
        missing tests, and regressions only. Do not implement fixes
        unless asked.",
  role="leaf",
  toolsets=["file", "terminal"]
)

Or use fleet specialist critic (cursor-subagent-cookbook).

B. Security review

1. Same diff scope as A.
2. In requesting-code-review, emphasize Step 2 (secrets, injection, eval, unsafe deserialize, SQL).
3. Extra leaf prompt:

goal="Security review only: secrets in source, authz gaps, injection,
      unsafe subprocess, path traversal. Severity + file:line. No style nits."

4. Never commit .env / tokens; secrets stay in .env only.

C. PR / CI babysit (when GitHub is allowed)

Use pr-babysit + github-code-review. Under the no-github / Timeweb policy, skip remote PR comments — verify locally and deploy with vibeos-local-verify-deploy.

D. Quick local gate (this repo)

scripts/run_tests.sh <touched-tests> -q
./scripts/smoke-cursor-adoption.sh   # if MCP/plugins touched
TIMEWEB_RUN_STRESS=0 ./scripts/deploy-timeweb.sh   # when shipping

Quick Reference

Cursor	VibeOS
/review / Bugbot subagent	requesting-code-review + critic leaf
/review-security	same + security-focused leaf prompt
Bugbot on a PR URL	checkout branch locally → A; or pr-babysit if GitHub OK
Inline PR comments	github-code-review (deferred if no-github)
Auto-fix loop	built into requesting-code-review

Procedure

1. Confirm scope: uncommitted vs branch vs named files.
2. Prefer independent reviewer (leaf/critic), not the same turn that wrote the code.
3. Fix Critical/High before commit; park Low as follow-ups.
4. Re-run the failing tests after fixes.
5. Ship via Timeweb when the task requires online path.

Pitfalls

• Re-reviewing with the same agent turn that authored the patch — misses bugs
• Calling GitHub APIs while no-github policy is active
• Treating agent/background_review.py as Bugbot — that module is session memory/skill maintenance, not a diff Bugbot
• Skipping scripts/run_tests.sh and using raw pytest (CI drift)

Verification

• Reviewer output lists findings with file paths (or “no issues”)
• New test failures from the change are zero vs baseline
• User can say “ship” / deploy only after Critical/High cleared