Claude Code Safety Hooks
Tested Claude Code hooks as a plugin: block rm -rf and force-push to main, protect .env and lockfiles, catch API keys in files, audit log. $19 once.
View Claude Code Safety Hooks
Type /code-review in Cursor and get a real review: 21 ready skills, installed in one command.

21 ready Agent Skills for Cursor: code review (general, Python, TypeScript/React, Java/Spring), security review, tests, debugging, refactoring, PR descriptions, commit messages, changelog, migrations, dependency upgrades, docs, performance, accessibility, release and staging-deploy workflows. Plus an installer, a converter that turns your old .cursor/commands into skills, and a SKILL.md validator.
Works anywhere SKILL.md folders load: Cursor (.cursor/skills, .agents/skills, .claude/skills, ~/.cursor/skills), Claude Code (.claude/skills) and Codex (.agents/skills). Python 3.9+ for the tools; the skills themselves are Markdown.
./tools/demo.sh # tour
python3 tools/install.py /path/to/repo # all 21 -> .cursor/skills/
python3 tools/install.py /path/to/repo --only code-review,security-review,write-tests
python3 tools/install.py --to user # ~/.cursor/skills for every projectIn Cursor Agent chat type /code-review (or @code-review). Skills with a description that matches your request also load on their own; the four workflow skills that act (pr-description, release-checklist, deploy-staging and any converted commands) only run when you type them.
| Skill | Runs | What it does |
|---|---|---|
| code-review | auto + / | prioritized findings (blockers / should-fix / nits) with a full checklist in references/ |
| code-review-python | **/*.py | mutable defaults, bare except, async blocking, typing, unsafe subprocess/pickle |
| code-review-typescript | **/*.ts(x) | any/casts, floating promises, effect deps, keys, client secrets |
| code-review-java | **/*.java | Optional misuse, try-with-resources, @Transactional proxies, N+1 |
| security-review | auto + / | entry point -> sink tracing, access control, secrets, deps (OWASP quick ref included) |
| write-tests | auto + / | deterministic tests in your framework's style |
| fix-failing-tests | auto + / | root cause first; never skips tests or loosens assertions |
| debug-error | auto + / | reproduce, hypotheses, verify, fix, regression test |
| refactor-safely | auto + / | small behaviour-preserving steps, characterization tests |
| explain-codebase | auto + / | one-screen map, entry points, request flow, where to start |
| add-api-endpoint | auto + / | contract first, validation, authz, consistent errors, tests |
| db-migration | auto + / | reversible, lock-safe, expand/contract, batched backfills |
| dependency-upgrade | auto + / | changelog review, one major at a time, risk summary |
| docs-update | auto + / | README/docs/.env.example in sync with the diff |
| changelog-entry | auto + / | Keep a Changelog entries from commits since the last tag |
| commit-message | auto + / | Conventional Commits from staged changes (scripts/staged_summary.sh) |
| performance-audit | auto + / | measure first, ranked fixes, before/after numbers |
| accessibility-check | UI files | WCAG 2.2 AA checks with code fixes |
| pr-description | / only | title + What/Why/How to test/Risk body from the branch |
| release-checklist | / only | semver, changelog, tag; stops before push/publish |
| deploy-staging | / only | template: tests, build, deploy, health check, smoke test (edit commands first) |
"auto" = the agent may load it when your request matches its description; "/ only" = disable-model-invocation: true. Path-scoped skills use the paths frontmatter so they only surface for matching files.
Cursor now treats skills as the home for reusable workflows (and /migrate-to-skills exists in Cursor 2.4+). If you'd rather see exactly what changes, or convert commands for another agent, use the converter:
python3 tools/commands_to_skills.py /path/to/repo --dry-run # preview
python3 tools/commands_to_skills.py /path/to/repo # writes .cursor/skills/<name>/SKILL.md, keeps the originals
python3 tools/commands_to_skills.py --user # ~/.cursor/commandsConverted skills keep command behaviour (disable-model-invocation: true); add --auto to let the agent pick them up on its own.
python3 tools/skill_lint.py .cursor/skills --target cursor checks frontmatter, names vs folders, descriptions, paths, broken file references and more (the same validator is free on its own as the SKILL.md Validator).
./run_tests.sh: every skill passes the validator for the spec, Claude Code, Cursor and Codex with zero warnings; referenced files exist; scripts are executable and run; installer and converter behaviour (skip/force/backup/dry-run, slugging, descriptions, validation). Python 3.13 and 3.10, from a fresh download.
Zip, 37 KB, v1.0, 35 files. You may use and modify this kit for your own work and for clients you serve, including paid client work. Not affiliated with Anysphere (Cursor), Anthropic or OpenAI.
21 tested Cursor Agent Skills (code review for Python/TS/Java, security, tests, PRs, migrations, releases), an installer and a commands-to-skills converter. $15.
Tested Claude Code hooks as a plugin: block rm -rf and force-push to main, protect .env and lockfiles, catch API keys in files, audit log. $19 once.
View Claude Code Safety HooksFree Claude Code hooks examples: SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, Notification and Stop, plus a local tester that checks your hook's output.
View Claude Code Hooks Starter (Free)24 Cursor rules (.mdc) for Next.js, TypeScript, React, Python, FastAPI, Django, Go, Rust and more. Detects your stack, installs in one command, lints your rules. $12 once.
View Cursor Rules PackShort weekly digest of new x402 + MCP tools and free kits, including the MCP OAuth Checker. No spam, unsubscribe any time.