[poteto]

Replaces #623 by @jhonnyisaacc. It keeps that PR's commit, rebased onto main, and adds one commit on top. The fork branch refused the rebased push, because main's commits change .github/workflows/validate-plugins.yml and the push token has no workflows permission on the fork.

Why

/reflect step 5 edits a skill in place. When the skill was read from the installed plugin cache (~/.cursor/plugins/cache/<marketplace>/<id>/<hash>/), a plugin update installs a new folder and the approved edit is lost.

#623 fixed that, but it sent every third-party skill edit to a PR on the repository in the plugin's plugin.json. All 119 plugin manifests on main have a repository field, so an approved local edit could become a public PR that the user never saw.

What changed

Step 5 gets one paragraph:

• Never edit a skill under plugins/cache/.
• Before approval, show its destination: .cursor/skills/<skill>/ or ~/.cursor/skills/<skill>/.
• After approval, copy the skill folder there and edit the copy.
• Never open a PR or push.

Other rows already show their path in the synthesizer's Routing cell, so the rest of step 5 and step 6 are unchanged from main. Regenerated harness/pstack/claude-code/skills/reflect/SKILL.md.

Tradeoffs

A local copy does not get later plugin updates for that skill, so it can drift from the plugin.

Cursor's docs list the project, user, and plugin skill locations, but they do not say which skill loads when a local skill and a plugin skill have the same name. I did not test which skill Cursor loads.

Verification

• node scripts/validate-plugins.mjs printed All plugins validated successfully.
• node scripts/generate-pstack-harness-trees.mjs --check printed harness/pstack is up to date.
• node scripts/check-pstack-docs.mjs printed 0 problems.
• No version, plugin.json, or marketplace file changed.

  

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Copied skills lose sibling paths

High Severity · Logic Bug

The new apply path copies only one plugin skill folder into .cursor/skills/ or ~/.cursor/skills/ and keeps its name. pstack skills resolve siblings and plugin-root files with paths like ../<name>/SKILL.md and ../../docs/. After that copy those links point at empty local trees, so a loaded local poteto-mode cannot find bundled skills or principles that poteto-agent expects next to it.

 

^{Reviewed by Cursor Bugbot for commit 402a2d4. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

There are 3 total unresolved issues (including 1 from previous review).

^{Reviewed by Cursor Bugbot for commit 661caad. Configure here.}

[cursor]

Recopy wipes existing local skills

Medium Severity · Logic Bug

After approval, step 5 always copies the plugin skill folder onto .cursor/skills/<skill>/ or ~/.cursor/skills/<skill>/. A later /reflect whose Routing still points at plugins/cache/ replaces that folder, so earlier approved edits in the local copy are lost.

 

^{Reviewed by Cursor Bugbot for commit 661caad. Configure here.}

[cursor]

Handoffs still target plugin cache

Medium Severity · Logic Bug

Substantive, tune, and new-skill rows still hand to create-skill using the row's Routing. Reviewers put the transcript's plugins/cache/ path in that column, and create-skill does not have the new never-edit rule, so those loops can write the approved edit back into the cache.

 

^{Reviewed by Cursor Bugbot for commit 661caad. Configure here.}