---
name: al-619-run-a-security-review-agent-on-every-push-to-main-it-audi
description: "Cursor's Automations launch post (cursor.com/blog/automations) describes always-on cloud agents triggered by schedules or events. One pattern Cursor uses internally: a security-review automation on every push to main that can run longer than a blocking PR check, skips findings already discussed on the PR, and posts only high-risk issues to Slack. The same post covers agentic codeowners, PagerDuty incident response, weekly repo digests and morning test-coverage agents. Use when the user wants help with scheduled security review on main (coding) for a small business."
---

# Run a security-review agent on every push to main: it audits the diff for real vulnerabilities, skips issues already discussed on the PR, and only posts high-risk findings to Slack

Cursor's Automations launch post (cursor.com/blog/automations) describes always-on cloud agents triggered by schedules or events. One pattern Cursor uses internally: a security-review automation on every push to main that can run longer than a blocking PR check, skips findings already discussed on the PR, and posts only high-risk issues to Slack. The same post covers agentic codeowners, PagerDuty incident response, weekly repo digests and morning test-coverage agents.

## Inputs to collect first
Ask the user for anything below that they haven't already given you. Don't guess missing facts.

- The material the task is about (pasted text, notes or data)

## Instructions

Do the task below with the user's inputs in place of each [bracket].

1. In Cursor Automations (or your CI + coding agent), create an agent that triggers on push to main (or merge to your release branch), not on every PR comment.
2. Give it read access to the repo, the PR conversation for the commits being pushed, and a Slack (or Teams) channel for security findings. No deploy credentials.
3. Instruct it: "Diff this push against the previous main. Look for auth gaps, injection, secret leaks, unsafe deserialization and permission bugs. Skip anything already discussed on the linked PR. Post only high-risk findings to Slack with file, line, why it matters and a suggested fix. Open a follow-up issue or PR only when the risk is clear."
4. Add a memory or checklist of false positives you have already dismissed so it improves over runs.
5. Review the first two weeks of posts yourself; tighten the prompt until noise is low enough that the channel stays trusted.

## Safety checks (share these with the user)

- Read and edit the draft before it reaches a customer or goes public. If you later automate this prompt, start with "draft and notify me", not "send automatically".
- Check names, dates, numbers and any claim against your own source material before you use the answer. AI can misread or invent details.
- Say clearly which parts need a person to review or approve before anything is sent, paid, posted or filed.

## About this skill

- Works with: Cursor Automations (cloud agents), GitHub/GitLab, Slack or Teams, optional security MCP tools
- Based on this real-world example: https://cursor.com/blog/automations
- Free prompt from AgentPlaybook Real Estate: https://agentic-library.netlify.app/prompt/al-619-run-a-security-review-agent-on-every-push-to-main-it-audits/
- To install in an agent that supports Agent Skills, save this file as SKILL.md in a folder with the same name as `name` above (for example in your skills directory). Install steps for Claude.ai, Claude Code, Cursor and Codex: https://agentic-library.netlify.app/skills/