Last mile

The files to put in front of the agent when the feature works and the remaining job is to ship it without a surprise. Complements Cursor’s Rollouts and Security Review bots; those stay in the product.

A pack of kits plus the install order that makes them work together.

Install path

Unzip the pack (this recipe expands to the kits below)

Includes

SkillFeatured
Security PR review
Trace user input, then patch — do not write a PoC.
A defensive pass for a pull request: injection, broken auth, secrets, SSRF, unsafe deserialization. Complements Cursor’s Security Review bot; this file is what the agent in the editor should follow.
securityreviewgit
RuleFeatured
No secrets in git
Tokens, keys, and .env stay out of the tree — including chat pastes.
A short always-on rule so the agent never commits credentials, writes them into source, or treats a token pasted in chat as something to store.
securitygitquality
Prompt
Keep this PR green
Subscribe, fix CI, answer review comments, then stop.
For a cloud agent on an open pull request. Uses Cursor’s PR subscription instead of you pasting logs.
gitciagents
Prompt
Make this change observable
Name the intended effect and the signals — or say what you cannot verify.
Paste with a diff before merge. Writes a monitoring plan a human (or Cursor Rollouts) can follow. Does not enable the Rollouts dashboard.
observabilityshipquality
Prompt
Review this diff like a skeptic
Bugs, missing states, and generic UI — not a compliment sandwich.
Paste with a diff or PR URL. Asks the agent to find breakage and slop, not to summarize the files.
reviewqualitygit
Skill
Commit craft
Write commits the next agent (and human) can trust.
A small procedure for staging, splitting, and describing work so git history stays usable — including when Cursor made the edits.
gitprocessquality

# Last mile

For the stretch between “the feature works on my machine” and “this change is safe to merge and watch.”

Install order

Rule: no-secrets.mdc (always-on, short).
Skills: security-pr-review, commit-craft.
Prompts: Review this diff like a skeptic, Keep this PR green, Make this change observable.

What this pack does not include

The Rollouts dashboard, the Security Review bot, or Bugbot. Enable those on Teams/Enterprise from Automations if you have them. This pack is the text the agent in the editor should follow on the same change.

Done when

The diff has a defensive review, no credentials in the tree, CI you would merge, and a written way to tell healthy from a regression after deploy.