Repository navigation
Record the Cursor Directory listing; route security reports to security@paymob.com - #13
Merged
Merged
Conversation
The plugin is now published at cursor.directory/plugins/paymob-integration, so the README's "no vendor listing anywhere" note was wrong. It now names the listing, keeps the still-true part about Anthropic's, OpenAI's and Lovable's directories, and adds Cursor as its own install path plus a badge. The Cursor entry says to install the Skill component alongside the three Command components. Each command resolves the skill's reference files at run time and stops rather than answering from memory when it cannot reach them, so a command installed on its own is safe but inert. SECURITY.md routed vulnerability reports to support@paymob.com. Paymob's security contact is security@paymob.com; support@ stays for non-security issues.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The plugin is now published on the Cursor Directory — the first vendor listing — and Paymob's security contact is
security@paymob.com, notsupport@.What was wrong
The README carried a note I added earlier stating the repo was the only distribution channel and that Paymob had "no listing yet" anywhere. That is now false.
SECURITY.mdrouted vulnerability reports tosupport@paymob.com, a general support inbox. A payments plugin's disclosure path should reach the security team directly.Changes
## Installationsection gains a matching subsection.security@paymob.com.support@paymob.comremains for non-security issues, which is now stated explicitly rather than conflated.One thing the Cursor entry calls out
The listing publishes the three commands as separate installable components. Each resolves the skill's reference files at run time, and per #9 stops rather than answering from memory when it can't reach them — so a command installed without the Skill component is safe but inert. The README now tells Cursor users to install the Skill alongside them, which is not obvious from the listing UI.
Test plan
python scripts/validate.pypassesclaude plugin validate .claude-plugin/plugin.jsonandclaude plugin validate . --strictboth passSeparate from this PR
The skill component submitted to the Cursor Directory uses
SKILL.mdas its Content, which contains 48 pointers toreferences/*.mdfiles that don't exist in a Cursor install — includinghmac-verification.md, where the field order actually lives. Swapping that field to the self-containeduniversal-prompt.mdbody is an edit on the listing, not in this repo.