Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/smk-labs/claude-plugins/cursor-orchestratenpx skills add smk-labs/claude-plugins --skill cursor-orchestrategit clone --depth 1 https://github.com/smk-labs/claude-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/smk-labs/claude-plugins/cursor-orchestrate)<a href="https://agentmods.dev/skills/smk-labs/claude-plugins/cursor-orchestrate"><img src="https://agentmods.dev/badge/skills/smk-labs/claude-plugins/cursor-orchestrate.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.03617 |
| Opus 5 | $0.00000 | $0.01809 |
| Sonnet 5 | $0.00000 | $0.00723 |
| Haiku 4.5 | $0.00000 | $0.00362 |
Grade D, and why
cursor-orchestrate scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
Requires the `cursor-delegate` plugin (this skill ships with it): the Cursor CLI installed (`curl https://cursor.com/install -fsS | bash`) and API keys in `~/.claude-deck/cursor/agent-keys.json` (chmod 600) with a `defau Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
Requires the `cursor-delegate` plugin (this skill ships with it): the Cursor CLI installed (`curl https://cursor.com/install -fsS | bash`) and API keys in `~/.claude-deck/cursor/agent-keys.json` (chmod 600) with a `defau Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Requires the `cursor-delegate` plugin (this skill ships with it): the Cursor CLI installed (`curl https://cursor.com/install -fsS | bash`) and API keys in `~/.claude-deck/cursor/agent-keys.json` (chmod 600) with a `defau How it starts
The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Orchestrate a Cursor fleet (Claude plans, Cursor executes)
Claude stays the brain: it owns architecture, UX/UI and design decisions, the plan, task decomposition, review/acceptance, and final integration. cursor-agent workers do the execution on the Cursor subscription's quota. This is agent calling at scale, not a model-backend swap.
Step 1 — pick the mode
Check the user's words first, then fall back to auto-detect by size:
| Signal | Mode |
|---|---|
| user said "sub" / "subagent" | A-simple: one cursor-worker subagent or a single cursor_run call |
| user said "workflow" / "w" | B: the JS harness (orchestrator.js) |
| ≤ 1 independent slice | A-simple |
| 2–8 independent slices | A-fan-out: several cursor_run calls in parallel |
| > 8 slices, or multi-phase build, or needs retries / worktrees / determinism | B: the JS harness |
State which mode you chose and why in one line.
Step 2 — decompose (Claude's job)
Cut the work into independent vertical slices. Each slice becomes one worker task. Write every task fully self-contained — the worker starts with a blank context and cannot see this conversation:
File paths to touch · the goal · acceptance criteria (how to know it's done) · what NOT to change. Reference the project's conventions by pointing at its
CLAUDE.md/AGENTS.md(see Context below), not by re-explaining them.
Bad: "add the auth we discussed." Good: "In src/auth/session.ts, add refresh(token) that returns a new JWT; it must reject tokens whose exp is in the past; add a Vitest in src/auth/session.test.ts covering expired + valid; do not touch src/auth/login.ts."
Step 3 — run it
One rule overrides everything: no single cursor-agent stream may live past ~4 minutes. Flaky networks (VPNs especially) kill streams at ~5-6 minutes — measured, not theoretical. Quick slices (< ~4 min) may use cursor_run; every longer slice runs legged: short legs on one --resumed session until the worker prints DONE-ALL (see the cursor-delegate skill).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 142 lines · 0 tokens per session scan D 34e28f099765
cursor-orchestrate is a skill published in the GitHub repository smk-labs/claude-plugins (11 stars, last pushed 4d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,617 tokens. A static security scan graded it D with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ab-test-analysis
Analyze A/B test results with statistical significance, sample size validation, confidence intervals, and ship/extend/stop recommendations. Use when evaluating experiment results, checking if a test reached significance, interpreting split test data, or deciding whether to ship a variant.
brainstorm-okrs
Brainstorm team-level OKRs aligned with company objectives — qualitative objectives with measurable key results. Use when setting quarterly OKRs, aligning team goals with company strategy, drafting objectives, or learning how to write effective OKRs.
dummy-dataset
Generate realistic dummy datasets for testing with customizable columns, constraints, and output formats (CSV, JSON, SQL, Python script). Use when creating test data, building mock datasets, or generating sample data for development and demos.
outcome-roadmap
Transform an output-focused roadmap into an outcome-focused one that communicates strategic intent. Rewrites initiatives as outcome statements reflecting user and business impacts. Use when shifting to outcome roadmaps, making a roadmap more strategic, or rewriting feature lists as outcomes.
pre-mortem
Run a pre-mortem risk analysis on a PRD or launch plan. Categorizes risks as Tigers (real problems), Paper Tigers (overblown concerns), and Elephants (unspoken worries), then classifies as launch-blocking, fast-follow, or track. Use when preparing for launch, stress-testing a product plan, or identifying what could go…
shipping-artifacts
The durable documentation set that makes an AI-built (vibe-coded) app reviewable before shipping. A small core every app needs — architecture, user/permission flows, permissions, variables/secrets, and a test-coverage map — plus conditional docs added only when they apply: emails, scheduled work, SEO, and embedded…