Cursor Kenji

Explain it like I'm five

Your AI editor is smart, but without a recipe it guesses. Sometimes that guess is great. Sometimes it invents a half-broken button and calls it done.

cursor-kenji is a big box of recipes (we call them skills). Install once. After that:

1. You type something normal — "check my security", "make this form nicer", "ship this feature".
2. Cursor picks the matching recipe.
3. The AI follows that recipe step by step, instead of freestyling.

You do not need to memorize skill names. Talking like a human is enough.

It ships 140 Cursor agent skills, 52 slash commands, and 6 subagents — tuned for React / Next.js / Supabase, useful on almost any stack. Works in Cursor, Claude Code, and (with a lighter install) Codex + Gemini CLI. Brand new? Read the plain-language guide →.

Install (30 seconds)

npx @kensaurus/cursor-kenji --all

That merge-installs skills and slash commands (and agents/rules) into every tool it supports, then hash-checks the copies. Restart Cursor. Done.

Skills only (no /commands)? npx skills add kensaurus/cursor-kenji — Vercel skills CLI, project-local by default (-g for ~/.cursor/skills). Its --all means “all skills to all agents”, not Cursor+Claude+Codex+Gemini.

No Cursor yet? Download it. See manual install.

What should I say? (use cases)

Highest-impact combo pipelines

You almost never want a single skill. Copy one of these into chat:

Full menu with every skill name → Every skill below. Combos with trigger phrases → docs/CATALOG.md — Skill Composition.

The five toys in the box

Everything follows the Agent Skills spec and is checked on every commit (npm test covers all 152 installable skills). MCP templates pin exact versions against package-hallucination attacks.

How the recipes fit together (the loop)

You almost never run one skill alone. Think of a simple loop — look → change → prove → ship — with seatbelts on the whole time:

   Orient          Assess           Change           Prove            Ship
(get to know) → (measure first) → (build/fix) → (test for real) → (go live)
      │                                                                      │
      └──────────────────── findings loop back ←─────────────────────────────┘
                              ▲
                     Guardrails always on
              (rules · hooks · "are we actually done?")

Rule of thumb: assess before you change, prove before you ship, never skip a stage.

Highest-impact prove loop: wander as guest + logged-in → ticket real bugs → lock them (test-exploratory → workflow-feedback-to-closure → test-playwright). Copy-paste phrases live in What should I say?.

What's Inside

The whole kit, at a glance:

Every skill is listed below — first a family count table, then the full name + one-line summary for each. Trigger phrases → docs/CATALOG.md · quick lookup → docs/TRIGGER-CHEATSHEET.md.

Every skill, in plain English

Scroll the family counts, then the full list. You don't memorize names — describe the job in chat and Cursor matches. Want exact trigger phrases? docs/CATALOG.md.

Auto-generated from each skill's SKILL.md — run npm run gen:skill-index after adding a skill. 152 skills listed below.

Skill families at a glance

Full list (every skill)

🔍 Audit — inspect; some then fix (29)

📋 Plan — audit first, change only after you approve (20)

🎨 Enhance — improve what already exists (15)

✨ Design — build something new (10)

🧱 Backend — server & data patterns (5)

📱 Mobile — React Native / Capacitor (5)

📊 Data — charts & pipelines (2)

📚 Docs — write it down clearly (3)

🧹 Housekeeping — clean up drift (3)

🔗 Workflows — multi-step recipes (19)

✅ Test & QA — prove it works (8)

🚀 Deploy — ship & verify (2)

🐛 Debug — find & fix what's broken (3)

🦟 Mushi Mushi — bug triage helpers (2)

🛡️ Protocols — session guardrails (1)

✍️ Authoring — build skills & MCP (2)

🤝 Third-party (upstream-maintained) (3)

🧩 Core & cross-cutting (8)

🖱️ Cursor IDE skills (12)

Quick Start

Pick whichever fits how you work. The first one covers most people.

npm installer modes:

npx @kensaurus/cursor-kenji            # merge — add/overwrite this repo's items (Cursor)
npx @kensaurus/cursor-kenji --auto     # detect installed tools and install to each
npx @kensaurus/cursor-kenji --claude   # install for Claude Code (~/.claude/) instead
npx @kensaurus/cursor-kenji --codex    # install for Codex CLI (~/.codex/AGENTS.md + prompts)
npx @kensaurus/cursor-kenji --gemini   # install for Gemini CLI (~/.gemini/GEMINI.md + commands)
npx @kensaurus/cursor-kenji --all      # install for all four supported tools in one run
npx @kensaurus/cursor-kenji --clean    # mirror ~/.cursor to match this repo (backup first)
npx @kensaurus/cursor-kenji --dry-run  # preview
npx @kensaurus/cursor-kenji --verify   # hash-check dests against this package (no writes)
npx @kensaurus/cursor-kenji --skill audit-ux   # single skill
npx @kensaurus/cursor-kenji --link     # dev: symlink for live skill authoring

Use more than one AI tool? Reach for --auto. It checks ~/.cursor, ~/.claude, ~/.codex, and ~/.gemini, then installs the right files to each one it finds. Running the bare command stays Cursor-only, so nothing changes for existing setups.

From a clone: npm run install:cursor · node bin/install.mjs --all (all tools) · npm test validates skills + count + install smoke test.

From any folder: npx @kensaurus/cursor-kenji --all. From a clone, node bin/install.mjs --all also works (Windows ships cursor-kenji.cmd so npx from the repo folder works too).

Optional — Mushi Mushi bug-report triage + AI draft PRs (pairs with mushi-health, test-playwright):

npx skills add kensaurus/mushi-mushi

After install: (1) Restart Cursor (2) Copy mcp/mcp.json.template → ~/.cursor/mcp.json, fill YOUR_* keys (3) Describe any task — skills match on keywords.

Authoring skills? Each skill must pass Agent Skills spec validation (npm run validate:skills): name matches directory, description ≤ 320 chars (house budget; spec max 1024), body < 500 lines.

Claude Code

One-click, no clone needed (works on Windows too):

npx @kensaurus/cursor-kenji --claude   # Claude Code only
npx @kensaurus/cursor-kenji --all      # all four supported tools

All skills, commands, agents, and rules install to Claude Code (~/.claude/), with .mdc rules installed as .md. Skills appear as /slash-commands — type / inside any claude session.

From a clone, the bash installer does the same:

# Install for Claude Code only
./install.sh --claude

# Install for both Cursor and Claude Code (default)
./install.sh

# Inside Claude Code — use skills as slash commands
/workflow-build-feature
/debug-error the login endpoint returns 401
/plan-security-audit
/docs-writer

Skills are read from ~/.claude/skills/<name>/SKILL.md. No restart required when you re-run the installer — Claude Code picks up file changes at the start of each new session.

Codex CLI & Gemini CLI

Codex CLI and Gemini CLI don't have a skills system yet. Each reads a single global context file instead, so cursor-kenji maps to exactly what they load:

npx @kensaurus/cursor-kenji --codex    # Codex CLI
npx @kensaurus/cursor-kenji --gemini   # Gemini CLI

Your rules/ get merged into that one auto-loaded file (the skill-routing index is skipped, since nothing here would load it). Three standalone playbooks — plan, research, and fix-issue — ship as native prompts/commands. Skills and subagents aren't written out, because neither tool can load them, so they'd only be dead files. Any existing AGENTS.md or GEMINI.md is backed up as .bak-<stamp> first, and re-running the installer is always safe.

The bash install.sh --codex/--gemini delegates to the Node installer (needs Node ≥ 18) so the merge/port logic has a single source of truth.

Manual install

git clone https://github.com/kensaurus/cursor-kenji.git && cd cursor-kenji && ./install.sh

curl -sSL https://raw.githubusercontent.com/kensaurus/cursor-kenji/main/install.sh | bash

Keep fresh: npx @kensaurus/cursor-kenji --all && npx @kensaurus/cursor-kenji --verify --all or git pull && ./install.sh

Workflows

You rarely run just one skill. You chain them. The picture at the top (How the recipes fit together) is the whole idea — this section is the same loop with more detail.

Stage cheat-sheet

Specialist audits worth knowing:

• audit-realworld — full-stack feature parity
• audit-resilience — timeouts, retries, idempotency, PII (the stuff agents skip)
• audit-backend-architecture — which distributed pattern to adopt vs skip as over-engineering
• audit-payment-system — double-charge, ledgers, webhooks, P