Run a security-review agent on every push to main: it audits the diff for real vulnerabilities, skips issues already discussed on the PR, and only posts high-risk findings to Slack: AI agent prompt
Cursor's Automations launch post (cursor.com/blog/automations) describes always-on cloud agents triggered by schedules or events. One pattern Cursor uses internally: a security-review automation on every push to main that can run longer than a blocking PR check, skips findings already discussed on the PR, and posts only high-risk issues to Slack. The same post covers agentic codeowners, PagerDuty incident response, weekly repo digests and morning test-coverage agents.
The prompt
1. In Cursor Automations (or your CI + coding agent), create an agent that triggers on push to main (or merge to your release branch), not on every PR comment. 2. Give it read access to the repo, the PR conversation for the commits being pushed, and a Slack (or Teams) channel for security findings. No deploy credentials. 3. Instruct it: "Diff this push against the previous main. Look for auth gaps, injection, secret leaks, unsafe deserialization and permission bugs. Skip anything already discussed on the linked PR. Post only high-risk findings to Slack with file, line, why it matters and a suggested fix. Open a follow-up issue or PR only when the risk is clear." 4. Add a memory or checklist of false positives you have already dismissed so it improves over runs. 5. Review the first two weeks of posts yourself; tighten the prompt until noise is low enough that the channel stays trusted.
How to use it
- Copy the prompt above.
- Replace every [bracket] with your own details (or fill in the blanks on AgentPlaybook Real Estate, which remembers your answers for the next prompt).
- Paste it into Cursor Automations (cloud agents), GitHub/GitLab, Slack or Teams and review the answer before you use it.
Works with: Cursor Automations (cloud agents), GitHub/GitLab, Slack or Teams, optional security MCP tools
Real-world example: cursor.com/blog/automations
Featured in: AI prompts to summarize meetings, notes, documents and reports
Before you use it: what to check
Check yourself
- Read and edit the draft before it reaches a customer or goes public. If you later automate this prompt, start with "draft and notify me", not "send automatically".
- Check names, dates, numbers and any claim against your own source material before you use the answer. AI can misread or invent details.
Using an AI agent? Download this prompt as a SKILL.md agent skill with these checks built in, or get the .zip for Claude.ai. How to install skills.
Want to make this prompt even better? Grade it with the free prompt grader or build your own with the AI prompt generator.
32 copy-paste agent prompts (PDF) plus 5 new prompts every week.
Get it free