Cursor 原生 Skills 实战指南：无需外部依赖，打造高效智能的代码审查工作流

name: "CodeReviewer Pro"
description: "Cross-language code review with security, style, and performance checks"
trigger:
  command: "/review"               # 用户输入触发词
  languages: ["python", "java", "go", "javascript", "typescript"]
context:
  include_file_path: true          # 注入当前文件路径
  include_project_root: true       # 注入项目根目录
prompt_template: |
  You are an expert senior software engineer specializing in secure, performant, and maintainable code.

  Review the following {{language}} code from file: {{file_path}}

  Focus on:
  1. Security vulnerabilities (e.g., SQLi, XSS, prototype pollution)
  2. Resource leaks (unclosed files, goroutines, streams)
  3. Style violations (PEP8, Google Java Style, etc.)
  4. Performance anti-patterns

  Output format:
  - [CRITICAL/HIGH/MEDIUM/LOW] Category: Brief description
    → Suggested fix: ...

  Code:
  ```{{language}}
  {{code}}

### 2.2 技能存储位置

Cursor 支持两类技能作用域：

| 类型 | 路径 | 用途 |
|------|------|------|
| **用户全局技能** | `～/.cursor/skills/` | 个人常用技能，如通用审查器 |
| **项目级技能** | `<项目根目录>/.cursor/skills/` | 团队专属规范，如内部安全策略 |

> 💡 推荐将 Code Reviewer 安装为 **全局技能**，以便跨项目复用。

---

## 三、动手创建：从零构建 Cross-Language Code Reviewer

### 步骤 1：创建技能目录

```bash
mkdir -p ～/.cursor/skills/code-reviewer-pro
cd ～/.cursor/skills/code-reviewer-pro

name: "CodeReviewer Pro"
version: "1.2"
author: "Your Name"
description: "Professional code reviewer for Python, Java, Go, JS/TS"
tags: ["security", "linting", "best-practices"]

# 触发方式
trigger:
  command: "/review"
  selection_required: true  # 必须选中代码才能触发

# 支持的语言
languages:
  - python
  - java
  - go
  - javascript
  - typescript

# 上下文注入
context:
  include_file_path: true
  include_language: true
  include_selection: true

# 核心提示模板（关键！）
prompt_template: |
  You are a world-class code reviewer with 15+ years of experience across multiple languages.
  Your job is to analyze the selected code snippet for critical issues.

  File: {{file_path}}
  Language: {{language}}

  RULES:
  - For Python: Check for SQL injection, missing type hints, PEP8 violations.
  - For Java: Look for unclosed resources, unchecked exceptions, non-final fields in immutable classes.
  - For Go: Detect goroutine leaks, ignored errors, context timeouts missing.
  - For JS/TS: Watch for prototype pollution, async race conditions, eval() usage.

  OUTPUT ONLY IN THIS FORMAT (no extra text):
  - [CRITICAL] Security: Description
    → Fix: Concrete suggestion
  - [HIGH] Resource Leak: Description
    → Fix: ...
  - [MEDIUM] Style: Description
    → Fix: ...
  - [LOW] Readability: Description
    → Fix: ...

  NEVER say "I think" or "maybe". Be authoritative.

  Code to review:
  ```{{language}}
  {{selection}}

### 步骤 3：重启 Cursor 或刷新技能缓存

在 Cursor 中按下 `Cmd+Shift+P`（Mac）或 `Ctrl+Shift+P`（Win/Linux），输入 **“Reload Skills”**，即可加载新技能。

---

## 四、实战演示：四语言下的原生审查体验

### 4.1 Python：SQL 注入 + 日志敏感信息

**选中代码**：
```python
def get_user(name):
    query = f"SELECT * FROM users WHERE name = '{name}'"
    return db.execute(query).fetchone()

[CRITICAL] Security: SQL injection via f-string interpolation
  → Fix: Use parameterized query: db.execute("SELECT ... WHERE name = ?", (name,))

public String read(String path) throws IOException {
    FileInputStream fis = new FileInputStream(path);
    return new String(fis.readAllBytes());
}

[HIGH] Resource Leak: FileInputStream not closed, may exhaust file descriptors
  → Fix: Use try-with-resources: try (FileInputStream fis = ...) { ... }

func fetch() string {
    resp, _ := http.Get("https://api.example.com")
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)
    return string(body)
}

[CRITICAL] Error Handling: Ignored error from http.Get, may panic if resp is nil
  → Fix: Check err != nil before using resp
[HIGH] Reliability: Missing context timeout for HTTP request
  → Fix: Use http.NewRequestWithContext with a timeout context

function merge(target, source) {
    for (let key in source) {
        target[key] = source[key]; // 危险！
    }
}

[CRITICAL] Security: Prototype pollution vulnerability via direct assignment
  → Fix: Use Object.assign({}, target, source) or validate key !== '__proto__'

- For Python: Enforce type hints on all function parameters and return types.

If any rule is violated, mark it as [HIGH] or [CRITICAL] based on severity.