Cursor Review Bridge

Map Cursor Bugbot and Security Review to VibeOS.

Skill metadata

Source	Bundled (installed by default)
Path	skills/software-development/cursor-review-bridge
Version	1.0.0
Author	VibeOS
License	MIT
Platforms	linux, macos, windows
Tags	cursor, review, bugbot, security, code-review, verification
Related skills	requesting-code-review, cursor-subagent-cookbook, github-code-review, pr-babysit, vibeos-local-verify-deploy

Reference: full SKILL.md

信息

The following is the complete skill definition that VibeOS loads when this skill is triggered. This is what the agent sees as instructions when the skill is active.

Cursor Review Bridge

Cursor’s /review, /review-bugbot, and /review-security launch dedicated review subagents on a local/PR diff. VibeOS does not ship Cursor’s Bugbot binary — map the same intent onto independent verification skills and leaves.

When to Use

• User asks for Bugbot / security review / “как /review в Cursor”
• Before commit or Timeweb deploy when changes touch code
• After a multi-file feature when the implementer should not self-verify

Prerequisites

• Repo checkout with git (local remotes OK; GitHub optional)
• Skill requesting-code-review for the full pre-commit pipeline
• Optional: fleet critic profile / delegate_task leaf for fresh context
• Tests via scripts/run_tests.sh (never bare pytest for this tree)

How to Run

A. Bugbot-like (find bugs / regressions)

1. Scope the diff (do not invent findings without reading it):

git diff --stat
git diff          # or: git diff main...HEAD

2. Run skill requesting-code-review end-to-end (static scan → tests → independent reviewer → auto-fix loop).
3. For a fresh-context pass (true Bugbot feel), spawn a leaf:

delegate_task(
  goal="Independent code review of the current diff. Report bugs,
        missing tests, and regressions only. Do not implement fixes
        unless asked.",
  role="leaf",
  toolsets=["file", "terminal"]
)

Or use fleet specialist critic (cursor-subagent-cookbook).

B. Security review

1. Same diff scope as A.
2. In requesting-code-review, emphasize Step 2 (secrets, injection, eval, unsafe deserialize, SQL).
3. Extra leaf prompt:

goal="Security review only: secrets in source, authz gaps, injection,
      unsafe subprocess, path traversal. Severity + file:line. No style nits."

4. Never commit .env / tokens; secrets stay in .env only.

C. PR / CI babysit (when GitHub is allowed)

Use pr-babysit + github-code-review. Under the no-github / Timeweb policy, skip remote PR comments — verify locally and deploy with vibeos-local-verify-deploy.

D. Quick local gate (this repo)

scripts/run_tests.sh <touched-tests> -q
./scripts/smoke-cursor-adoption.sh   # if MCP/plugins touched
TIMEWEB_RUN_STRESS=0 ./scripts/deploy-timeweb.sh   # when shipping

Quick Reference

Cursor	VibeOS
/review / Bugbot subagent	requesting-code-review + critic leaf
/review-security	same + security-focused leaf prompt
Bugbot on a PR URL	checkout branch locally → A; or pr-babysit if GitHub OK
Inline PR comments	github-code-review (deferred if no-github)
Auto-fix loop	built into requesting-code-review

Procedure

1. Confirm scope: uncommitted vs branch vs named files.
2. Prefer independent reviewer (leaf/critic), not the same turn that wrote the code.
3. Fix Critical/High before commit; park Low as follow-ups.
4. Re-run the failing tests after fixes.
5. Ship via Timeweb when the task requires online path.

Pitfalls

• Re-reviewing with the same agent turn that authored the patch — misses bugs
• Calling GitHub APIs while no-github policy is active
• Treating agent/background_review.py as Bugbot — that module is session memory/skill maintenance, not a diff Bugbot
• Skipping scripts/run_tests.sh and using raw pytest (CI drift)

Verification

• Reviewer output lists findings with file paths (or “no issues”)
• New test failures from the change are zero vs baseline
• User can say “ship” / deploy only after Critical/High cleared