From 930c73e589cb45d9df8ce2a218e382d8159470df Mon Sep 17 00:00:00 2001 From: Mohamed Ragab Date: Sat, 15 Aug 2026 11:20:26 +0300 Subject: [PATCH] Record the Cursor Directory listing; use security@paymob.com The plugin is now published at cursor.directory/plugins/paymob-integration, so the README's "no vendor listing anywhere" note was wrong. It now names the listing, keeps the still-true part about Anthropic's, OpenAI's and Lovable's directories, and adds Cursor as its own install path plus a badge. The Cursor entry says to install the Skill component alongside the three Command components. Each command resolves the skill's reference files at run time and stops rather than answering from memory when it cannot reach them, so a command installed on its own is safe but inert. SECURITY.md routed vulnerability reports to support@paymob.com. Paymob's security contact is security@paymob.com; support@ stays for non-security issues. --- README.md | 33 ++++++++++++++++++++++++++------- SECURITY.md | 4 ++-- 2 files changed, 28 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index eba679f..d0aa82b 100644 --- a/README.md +++ b/README.md @@ -4,6 +4,7 @@ ![license](https://img.shields.io/badge/license-MIT-green) ![works with](https://img.shields.io/badge/works%20with-Claude%20%C2%B7%20Lovable%20%C2%B7%20Cursor%20%C2%B7%20Windsurf%20%C2%B7%20Copilot%20%C2%B7%20Codex-8A2BE2) ![regions](https://img.shields.io/badge/regions-EGY%20%C2%B7%20UAE%20%C2%B7%20KSA%20%C2%B7%20OMN-orange) +[![Cursor Directory](https://img.shields.io/badge/Cursor%20Directory-listed-000000)](https://cursor.directory/plugins/paymob-integration) Lovable Lovable **Claude.ai / ChatGPT / Lovable skill upload:** [Download `paymob-integration.zip`](https://github.com/PaymobAccept/Paymob-AI-Integration-Skill/releases/latest/download/paymob-integration.zip) — do not use GitHub's **Code → Download ZIP**. @@ -12,7 +13,7 @@ Give any AI coding agent expert, **workflow-driven** knowledge of the [Paymob](h Ships as a native **Codex/ChatGPT plugin**, a **Claude Code/Cowork plugin**, a tested **Lovable workspace skill**, and a portable prompt (`universal-prompt.md`) + `AGENTS.md` for Cursor, Windsurf, GitHub Copilot, Gemini, and other agents. -> **This repository is the distribution channel.** Paymob has no listing yet in Anthropic's plugin directory, OpenAI's, or Lovable's marketplace, and the Paymob MCP server is not in any vendor connector registry. If you search a vendor marketplace for "Paymob" and find nothing, that's expected — not a mistake on your end. Every method below installs straight from this repo (or its release ZIP) and works today; the Claude Code path registers this repo as a *custom* marketplace, which needs no vendor listing. Vendor listings are something we hope to add later. +> **Where it's listed.** Published on the [Cursor Directory](https://cursor.directory/plugins/paymob-integration). Not yet listed in Anthropic's plugin directory, OpenAI's, or Lovable's marketplace, and the Paymob MCP server is not yet in a vendor connector registry — so if you search one of those for "Paymob" and find nothing, that's expected rather than a mistake on your end. No listing is required either way: every method below installs straight from this repo (or its release ZIP), and the Claude Code path registers this repo as a *custom* marketplace. --- @@ -43,7 +44,7 @@ The agent fetches the skill and puts it wherever its own convention expects. Tes Two things this path deliberately does *not* do: -- **It doesn't register the Paymob MCP server**, so there's no live account access (payment links, transactions, balances, settlements). Agents leave it out on purpose — it's a persistent config change pointing at a live financial service. To get it, use the Claude Code plugin install (item 7 below), which bundles it, or add it yourself per [Live access](#live-access--paymob-mcp-server). +- **It doesn't register the Paymob MCP server**, so there's no live account access (payment links, transactions, balances, settlements). Agents leave it out on purpose — it's a persistent config change pointing at a live financial service. To get it, use the Claude Code plugin install (item 8 below), which bundles it, or add it yourself per [Live access](#live-access--paymob-mcp-server). - **It doesn't namespace the skill.** Install it this way *and* as a plugin and you'll have two `paymob-integration` skills with identical descriptions; disable one to clear the ambiguity. ### 2. OpenAI Codex → install the standalone skill @@ -68,7 +69,19 @@ Targeting the `skills/paymob-integration` subdirectory is required; the reposito You need a workspace owner, admin, or editor role to import a custom skill. Although Lovable also supports public GitHub imports, use the release ZIP for this repository: Lovable accepts `SKILL.md` only at the repository root or inside one wrapping folder, while this multi-agent plugin intentionally keeps it at `skills/paymob-integration/SKILL.md`. -### 4. Coding agents → drop in `AGENTS.md` +### 4. Cursor → install from the Cursor Directory + +Listed at **[cursor.directory/plugins/paymob-integration](https://cursor.directory/plugins/paymob-integration)**. Open the listing and use **Add to Cursor** on the component you want: + +| Component | What it gives you | +|---|---| +| **Skill** `paymob-integration` | The full integration guidance | +| **MCP Server** `paymob` | Live account access — payment links, transactions, balances, settlements | +| **Commands** ×3 | `/paymob-test-cards`, `/paymob-explain-error`, `/paymob-check-hmac` | + +The three commands read the skill's reference files at run time, so install the **Skill** component alongside them — on its own, a command will correctly refuse to answer rather than guess at a field order it cannot read. + +### 5. Coding agents → drop in `AGENTS.md` [`AGENTS.md`](https://agents.md) is an open standard that coding agents read **automatically** from your project's root folder. Natively supported by **OpenAI Codex, Cursor, GitHub Copilot, Windsurf, Gemini CLI, Aider, Zed, Jules, Devin, Factory, Amp, RooCode, Warp, JetBrains Junie**, and more. @@ -82,13 +95,13 @@ curl -O https://raw.githubusercontent.com/PaymobAccept/Paymob-AI-Integration-Ski - Already have an `AGENTS.md`? Just paste this one's contents into it under a `## Paymob` heading. - Now ask your agent in plain English — *"Add Paymob card payments to my checkout"* — and it follows the Paymob rules automatically. -### 5. Chat assistants (ChatGPT · Gemini · Claude.ai · Copilot Chat …) → paste `universal-prompt.md` +### 6. Chat assistants (ChatGPT · Gemini · Claude.ai · Copilot Chat …) → paste `universal-prompt.md` 1. Open [`universal-prompt.md`](universal-prompt.md) and **copy the whole file**. 2. Paste it into the assistant's **system prompt** / **custom instructions** (ChatGPT: *Settings → Personalization → Custom instructions*; Gemini: a *Gem*; Claude.ai: a *Project*'s instructions). 3. Describe what you're building. It's fully self-contained — no other files needed. -### 6. Prefer a pinned editor rules file? (optional) +### 7. Prefer a pinned editor rules file? (optional) If you'd rather use your editor's native rules file instead of `AGENTS.md`, save [`universal-prompt.md`](universal-prompt.md) as: @@ -99,7 +112,7 @@ If you'd rather use your editor's native rules file instead of `AGENTS.md`, save | GitHub Copilot | `.github/copilot-instructions.md` | | Cline · Continue · Roo | the tool's rules / context file | -### 7. Claude Code / Cowork → install the full plugin +### 8. Claude Code / Cowork → install the full plugin Pick this over item 1 when you want the **bundled live Paymob MCP server** (see [below](#live-access--paymob-mcp-server)) and namespaced plugin commands. Add this repository as a marketplace, then install the plugin: @@ -247,7 +260,13 @@ The repository's `.claude-plugin/marketplace.json` makes the GitHub repository a Add `PaymobAccept/Paymob-AI-Integration-Skill` as a custom marketplace source, then install **Paymob Integration** from that marketplace. -### Other agents (Cursor, Windsurf, Copilot, …) +### Cursor (Cursor Directory) + +Listed at [cursor.directory/plugins/paymob-integration](https://cursor.directory/plugins/paymob-integration). Use **Add to Cursor** on the listing for the skill, the `paymob` MCP server, and the three commands. + +Install the **Skill** component alongside the commands. Each command resolves the skill's reference files at run time and stops rather than answering from memory if it can't reach them, so a command installed on its own is safe but inert. + +### Other agents (Windsurf, Copilot, …) ```bash git clone https://github.com/PaymobAccept/Paymob-AI-Integration-Skill.git diff --git a/SECURITY.md b/SECURITY.md index a030679..a1b5958 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -6,7 +6,7 @@ This repository ships integration guidance and tooling for the Paymob payment ga **Preferred:** open a [GitHub Security Advisory](https://github.com/PaymobAccept/Paymob-AI-Integration-Skill/security/advisories/new) for this repository. This reaches the maintainers privately and lets us coordinate a fix and disclosure timeline before any details go public. -**Alternative:** email **support@paymob.com** with a subject line starting `SECURITY:` and a description of the issue. Do not include real API keys, Secret Keys, or HMAC secrets in a report — a redacted example or a synthetic reproduction is enough for us to investigate. +**Alternative:** email **security@paymob.com** with a subject line starting `SECURITY:` and a description of the issue. Do not include real API keys, Secret Keys, or HMAC secrets in a report — a redacted example or a synthetic reproduction is enough for us to investigate. Please do not open a public issue or pull request that discloses an unpatched vulnerability, since this repository's content is consumed directly by AI coding agents integrating live payment flows. @@ -28,4 +28,4 @@ This project is distributed as source (a Claude Code / Codex plugin, a portable ## Scope -This policy covers the content and packaging in this repository (`skills/`, `commands/`, `.claude-plugin/`, `.codex-plugin/`, `.mcp.json`, `AGENTS.md`, `universal-prompt.md`, and the validation/packaging scripts). It does not cover Paymob's own APIs, dashboard, or the `https://mcp.paymob.com/mcp` server's implementation — report those directly to Paymob support at **support@paymob.com** or through your account manager. +This policy covers the content and packaging in this repository (`skills/`, `commands/`, `.claude-plugin/`, `.codex-plugin/`, `.mcp.json`, `AGENTS.md`, `universal-prompt.md`, and the validation/packaging scripts). It does not cover Paymob's own APIs, dashboard, or the `https://mcp.paymob.com/mcp` server's implementation — report a vulnerability in any of those to **security@paymob.com**, or raise a non-security issue with **support@paymob.com** or your account manager.