Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/elastic/cursor-plugins/elasticsearch-authznpx skills add elastic/cursor-plugins --skill elasticsearch-authzgit clone --depth 1 https://github.com/elastic/cursor-pluginsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00044 | $0.05101 |
| Opus 5 | $0.00022 | $0.02550 |
| Sonnet 5 | $0.00009 | $0.01020 |
| Haiku 4.5 | $0.00004 | $0.00510 |
Grade A, and why
elasticsearch-authz scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl "${ELASTICSEARCH_URL}/_security/role" <auth_flags> This is a copy
100% identical to elasticsearch-authz — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 538 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Elasticsearch Authorization
Manage Elasticsearch role-based access control: native users, roles, role assignment, and role mappings for external realms.
For authentication methods and API key management, see the elasticsearch-authn skill.
For detailed API endpoints, see references/api-reference.md.
Deployment note: Feature availability differs between self-managed, ECH, and Serverless. See Deployment Compatibility for details.
Jobs to Be Done
- Create a native user with a specific set of privileges
- Define a custom role with least-privilege index and cluster access
- Assign one or more roles to an existing user
- Create a role with Kibana feature or space privileges
- Configure a role mapping for external realm users (SAML, LDAP, PKI)
- Derive role assignments dynamically from user attributes (Mustache templates)
- Restrict document visibility per user or department (document-level security)
- Hide sensitive fields like PII from certain roles (field-level security)
- Implement attribute-based access control (ABAC) using templated role queries
- Translate a natural-language access request into user, role, and role mapping tasks
Prerequisites
| Item | Description |
|---|---|
| Elasticsearch URL | Cluster endpoint (e.g. https://localhost:9200 or a Cloud deployment URL) |
| Kibana URL | Required only when setting Kibana feature/space privileges |
| Authentication | Valid credentials (see the elasticsearch-authn skill) |
| Cluster privileges | manage_security is required for user and role management operations |
Prompt the user for any missing values.
Decomposing Access Requests
When the user describes access in natural language (e.g. "create a user that has read-only access to logs-*"), break
the request into discrete tasks before executing. Follow this workflow:
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 538 lines · 44 tokens per session scan A b0b478791a0b
elasticsearch-authz is a skill published in the GitHub repository elastic/cursor-plugins (31 stars, last pushed 6d ago), licensed Apache-2.0. It adds 44 tokens to every session and 5,101 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). It is 100% identical to elasticsearch-authz, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
agent-platform-rag-engine-management
Manage and query Agent Platform RAG Engine Corpora and retrieve grounded contexts using the Google GenAI SDK. Use when listing RAG corpora or files, inspecting a corpus, retrieving contexts, or generating content grounded in a RAG corpus. Do not use for standard database queries (use SQL/Spanner skills), Google…
bigquery-ai-ml
Leverages BigQuery's built-in machine learning and GenAI capabilities for advanced data analytics. Use when you need to write SQL queries that perform time-series forecasting, predict values, detect outliers or anomalies, find key drivers, perform semantic search or vector search, classify text, calculate similarity…
prisma-upgrade-v7
Complete migration guide from Prisma ORM v6 to v7 covering all breaking changes. Use when upgrading Prisma versions, encountering v7 errors, or migrating existing projects. Triggers on "upgrade to prisma 7", "prisma 7 migration", "prisma-client generator", "driver adapter required".
ddia-systems
Design data systems by understanding storage engines, replication, partitioning, transactions, and consistency models. Use when the user mentions "database choice", "which database should I use", "SQL or NoSQL", "replication lag", "partitioning strategy", "consistency vs availability", "stream processing", "ACID…
sqlitecpp-update-sqlite
How to update the bundled SQLite3 amalgamation (sqlite3/sqlite3.c and sqlite3.h), the Meson wrap, README.md, and CHANGELOG.md. Use when upgrading SQLite, refreshing the vendored amalgamation, or bumping the sqlite3 wrap.
dsql
Build with Aurora DSQL — manage schemas, execute queries, handle migrations, diagnose query plans, diagnose cluster performance, load data, and develop applications with a serverless, distributed SQL database. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL and PostgreSQL-to-DSQL schema conversion, FK…