Add Cursor skill (skill-cursor.md) for /graphify parity with Codex/Claude — fixes #3158 - #3174
Add Cursor skill (skill-cursor.md) for /graphify parity with Codex/Claude — fixes #3158#3174AromalBiju1 wants to merge 2 commits into
Conversation
There was a problem hiding this comment.
Graphify reviewed this change.
Worth a look — the grounded gate found no coupling regressions or blocking issues, but 5 advisory finding(s) below merit a look before merge.
Formal verification. 1 change(s) tested, no difference found (not proven).
Graphify review — findings
Adds Cursor as a first-class platform: _cursor_install now writes both the always-on .cursor/rules/graphify.mdc rule and a new skill-cursor.md command at .cursor/commands/graphify.md, so /graphify has a defined pipeline procedure on Cursor rather than just a context nudge. _cursor_uninstall correspondingly removes both files and reports "nothing to remove" when neither exists. Registers the cursor platform config and covers the install/uninstall behaviour and skill content in tests.
Worth a look
- Shell command injection via unsanitized INPUT_PATH in cd —
graphify/skill-cursor.md· Escalate · high- agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
- Unvalidated INPUT_PATH substituted into Python source string —
graphify/skill-cursor.md· Escalate · high- agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
- Cached-only semantic path skips creating required semantic file —
graphify/skill-cursor.md· Escalate · high- agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
- INPUT_PATH is embedded into Python source without escaping —
graphify/skill-cursor.md:114· Escalate · high- agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
- Chunk merge reads all shared chunk files without run isolation —
graphify/skill-cursor.md· Escalate · medium- agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 509 functions depend on the 307 functions this change touches.
Health — this change adds coupling hotspots:
- new:
dispatch_command()— 2 callers, 122 callees - new:
codebuddy_install()— 20 callers, 5 callees - new:
claude_install()— 19 callers, 4 callees - new:
gemini_install()— 10 callers, 7 callees - new:
claude_uninstall()— 17 callers, 4 callees - new:
_project_uninstall()— 5 callers, 13 callees - new:
dispatch_install_cli()— 2 callers, 31 callees - new:
codebuddy_uninstall()— 14 callers, 4 callees - …and 13 more — each is listed as a finding
Verification — 509 functions in the blast radius were not formally verified this run (proofs are advisory here).
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 439 function(s) in the blast radius were not formally verified this run
Formal verification
Could not verify: Could not verify \_cursor\_install.
The verifier did not have enough to check \_cursor\_install, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: not verifiable: all 29 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly TypeError — names the real obstacle, not a sampling gap)
No difference found (not proven): No behavior difference found in \_cursor\_uninstall (not a proof).
The verifier ran both versions of \_cursor\_uninstall on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.
Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.
Note: An input the sampler did not try could still differ.
· 21 more finding(s) on lines outside this diff (see the check run).
Closes #3158.
graphify cursor installonly ever wrote.cursor/rules/graphify.mdc— thealways-on nudge toward
graphify querybefore raw file exploration. Unlikeevery other platform, Cursor never got the actual skill: the step-by-step
/graphifypipeline (detect → extract → build → cluster → export) thatCodex gets via
skill-codex.mdand Claude Code gets viaskill.md.This adds
graphify/skill-cursor.mdand wires it into_cursor_install/_cursor_uninstallvia the existing_PLATFORM_CONFIG/_copy_skill_filemachinery (same path Codex/OpenCode/Kilo already use), writing it to
.cursor/commands/graphify.mdso/graphifyis available in Cursor's chat.Extraction in Part B runs sequentially rather than via parallel subagent
dispatch, since Cursor's parallel/background agents are separate sessions
launched from Cursor's own UI/API, not an in-chat tool the assistant can
call mid-conversation — same fallback already used for Aider/OpenClaw.
Also fixes
_cursor_uninstall, which previously only removed the rule file;it now also removes the new skill file and its
references/sidecar.Tests added in tests/test_install.py covering install/uninstall of the new
skill file, the references sidecar, and the full CLI round-trip.
Update: tests/test_wheel_packaging.py caught that skill-cursor.md was committed but not covered by [tool.setuptools.package-data] in pyproject.toml — it would have shipped in the repo but not in the built wheel, causing graphify install --platform cursor to hard-exit for real users. Fixed in the latest commit. Ran the full local CI parity suite (skillgen --check, --audit-coverage, --monolith-roundtrip, --always-on-roundtrip, and pytest tests/ -q) — all green (5117 passed).