Add ambassador skill and gitignore local secrets#392
Conversation
Introduce a Cursor skill for granting ambassador badges via Supabase and extend .gitignore to exclude .env.local and .vercel from commits. Co-authored-by: Cursor <cursoragent@cursor.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default mode and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 85cf31b. Configure here.
| UPDATE public.users | ||
| SET is_ambassador = true | ||
| WHERE id = '<user_id>' | ||
| RETURNING id, name, slug, email, is_ambassador; |
There was a problem hiding this comment.
Unescaped SQL in skill
High Severity · Security Issue
The skill tells the agent to paste the user’s email, name, or UUID directly into SQL string literals for SELECT and UPDATE against production public.users. A crafted identifier can break out of the quoted value and run arbitrary SQL under whatever privileges the Supabase MCP connection has.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 85cf31b. Configure here.
1 participant
Summary
.cursor/skills/add-cursor-ambassadorskill to grant ambassador badges via Supabase MCP (lookup by name/email, setusers.is_ambassador).cursor/settings.jsonfor project Cursor settings.gitignoreto exclude.env.local,.env*.local, and.react-emailalongside existing.vercel/rulesTest plan
.env.localand.vercel/no longer appear as untracked ingit status/add-cursor-ambassadorwith a test email and verify Supabase MCP flowMade with Cursor
Note
Low Risk
Low risk: adds Cursor editor configuration and a documented MCP skill, plus
.gitignoretweaks; no runtime application code changes.Overview
Adds a new Cursor skill (
.cursor/skills/add-cursor-ambassador/SKILL.md) that documents a Supabase MCP workflow to look up a cursor.directory user by email/name/UUID and setpublic.users.is_ambassador(with guidance for disambiguation and optional revocation).Enables the Supabase Cursor plugin via
.cursor/settings.json, and extends.gitignoreto exclude.env*.localand.react-emailartifacts.Reviewed by Cursor Bugbot for commit 85cf31b. Bugbot is set up for automated code reviews on this repo. Configure here.