Cursor Skills Pack: 21 SKILL.md Workflow Skills + Commands-to-Skills Converter

Type /code-review in Cursor and get a real review: 21 ready skills, installed in one command.

Cursor Skills Pack: 21 SKILL.md Workflow Skills + Commands-to-Skills Converter product illustration

What it does

21 ready Agent Skills for Cursor: code review (general, Python, TypeScript/React, Java/Spring), security review, tests, debugging, refactoring, PR descriptions, commit messages, changelog, migrations, dependency upgrades, docs, performance, accessibility, release and staging-deploy workflows. Plus an installer, a converter that turns your old .cursor/commands into skills, and a SKILL.md validator.

Works anywhere SKILL.md folders load: Cursor (.cursor/skills, .agents/skills, .claude/skills, ~/.cursor/skills), Claude Code (.claude/skills) and Codex (.agents/skills). Python 3.9+ for the tools; the skills themselves are Markdown.

60-second demo

./tools/demo.sh                                            # tour
python3 tools/install.py /path/to/repo                     # all 21 -> .cursor/skills/
python3 tools/install.py /path/to/repo --only code-review,security-review,write-tests
python3 tools/install.py --to user                         # ~/.cursor/skills for every project

In Cursor Agent chat type /code-review (or @code-review). Skills with a description that matches your request also load on their own; the four workflow skills that act (pr-description, release-checklist, deploy-staging and any converted commands) only run when you type them.

The skills

SkillRunsWhat it does
code-reviewauto + /prioritized findings (blockers / should-fix / nits) with a full checklist in references/
code-review-python**/*.pymutable defaults, bare except, async blocking, typing, unsafe subprocess/pickle
code-review-typescript**/*.ts(x)any/casts, floating promises, effect deps, keys, client secrets
code-review-java**/*.javaOptional misuse, try-with-resources, @Transactional proxies, N+1
security-reviewauto + /entry point -> sink tracing, access control, secrets, deps (OWASP quick ref included)
write-testsauto + /deterministic tests in your framework's style
fix-failing-testsauto + /root cause first; never skips tests or loosens assertions
debug-errorauto + /reproduce, hypotheses, verify, fix, regression test
refactor-safelyauto + /small behaviour-preserving steps, characterization tests
explain-codebaseauto + /one-screen map, entry points, request flow, where to start
add-api-endpointauto + /contract first, validation, authz, consistent errors, tests
db-migrationauto + /reversible, lock-safe, expand/contract, batched backfills
dependency-upgradeauto + /changelog review, one major at a time, risk summary
docs-updateauto + /README/docs/.env.example in sync with the diff
changelog-entryauto + /Keep a Changelog entries from commits since the last tag
commit-messageauto + /Conventional Commits from staged changes (scripts/staged_summary.sh)
performance-auditauto + /measure first, ranked fixes, before/after numbers
accessibility-checkUI filesWCAG 2.2 AA checks with code fixes
pr-description/ onlytitle + What/Why/How to test/Risk body from the branch
release-checklist/ onlysemver, changelog, tag; stops before push/publish
deploy-staging/ onlytemplate: tests, build, deploy, health check, smoke test (edit commands first)

"auto" = the agent may load it when your request matches its description; "/ only" = disable-model-invocation: true. Path-scoped skills use the paths frontmatter so they only surface for matching files.

Move from commands to skills

Cursor now treats skills as the home for reusable workflows (and /migrate-to-skills exists in Cursor 2.4+). If you'd rather see exactly what changes, or convert commands for another agent, use the converter:

python3 tools/commands_to_skills.py /path/to/repo --dry-run   # preview
python3 tools/commands_to_skills.py /path/to/repo             # writes .cursor/skills/<name>/SKILL.md, keeps the originals
python3 tools/commands_to_skills.py --user                    # ~/.cursor/commands

Converted skills keep command behaviour (disable-model-invocation: true); add --auto to let the agent pick them up on its own.

Validate your own skills

python3 tools/skill_lint.py .cursor/skills --target cursor checks frontmatter, names vs folders, descriptions, paths, broken file references and more (the same validator is free on its own as the SKILL.md Validator).

How it was tested

./run_tests.sh: every skill passes the validator for the spec, Claude Code, Cursor and Codex with zero warnings; referenced files exist; scripts are executable and run; installer and converter behaviour (skip/force/backup/dry-run, slugging, descriptions, validation). Python 3.13 and 3.10, from a fresh download.

Honest limits

  • Skills are instructions: the agent follows them well but not perfectly, and results depend on the model.
  • deploy-staging is a template; edit its commands before first use. Nothing here deploys or publishes without you confirming.
  • Not affiliated with Anysphere (Cursor), Anthropic or OpenAI.

Format and license

Zip, 37 KB, v1.0, 35 files. You may use and modify this kit for your own work and for clients you serve, including paid client work. Not affiliated with Anysphere (Cursor), Anthropic or OpenAI.

FAQ

Does it work outside Cursor?
Yes. The skills follow the open Agent Skills format, so they also load in Claude Code (.claude/skills) and Codex (.agents/skills); the installer has --to claude and --to agents.
Will the deploy and release skills run on their own?
No. pr-description, release-checklist and deploy-staging are marked disable-model-invocation: true, so they only run when you type them, and they stop for confirmation before pushing, publishing or deploying.
What does the converter change?
It turns each .cursor/commands/*.md into .cursor/skills/<name>/SKILL.md with a name and description, keeps command behaviour (only runs on /name), leaves the originals in place unless --remove, and validates every result.
How do I get the files?
Pay by card right here on youraitools.co: your download links appear on this page the moment the payment goes through (claim window: 72 hours, up to 5 downloads per 7 days). Need the files re-sent later? Email hello@youraitools.co.
Refunds?
Email hello@youraitools.co within 14 days if it doesn’t work and we can’t fix it.
Can I pay with crypto?
Yes. Pay the same price in USDC or USDT on Base, Ethereum, Arbitrum, Optimism, Polygon or Solana from the "Pay with crypto" button, with no account or KYC. We check the payment on-chain and show your download links as soon as it confirms.

Get Cursor Skills Pack: 21 SKILL.md Workflow Skills + Commands-to-Skills Converter

21 tested Cursor Agent Skills (code review for Python/TS/Java, security, tests, PRs, migrations, releases), an installer and a commands-to-skills converter. $15.

Pairs well with

Download$19

Claude Code Safety Hooks

Tested Claude Code hooks as a plugin: block rm -rf and force-push to main, protect .env and lockfiles, catch API keys in files, audit log. $19 once.

View Claude Code Safety Hooks
DownloadFree

Claude Code Hooks Starter (Free)

Free Claude Code hooks examples: SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, Notification and Stop, plus a local tester that checks your hook's output.

View Claude Code Hooks Starter (Free)
Download$12

Cursor Rules Pack

24 Cursor rules (.mdc) for Next.js, TypeScript, React, Python, FastAPI, Django, Go, Rust and more. Detects your stack, installs in one command, lints your rules. $12 once.

View Cursor Rules Pack

Related

1 email a week: new x402 + MCP tools and free kits.

Short weekly digest of new x402 + MCP tools and free kits, including the MCP OAuth Checker. No spam, unsubscribe any time.