Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/bonnguyenitc/specship/workflowgit clone --depth 1 https://github.com/bonnguyenitc/specshipWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00446 | $0.00446 |
| Opus 5 | $0.00223 | $0.00223 |
| Sonnet 5 | $0.00089 | $0.00089 |
| Haiku 4.5 | $0.00045 | $0.00045 |
Grade A, and why
WORKFLOW scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
For any non-trivial change, follow .cursor/skills/WORKFLOW.md and the per-stage
playbooks in .cursor/skills/ss-<stage>/SKILL.md (spec → plan → coding → review;
debug as needed; ss-ship = autopilot that runs spec → plan → coding → review
end-to-end from a feature request; ss-resume-task = re-entry that locates an
in-progress/paused task, reports where it stands, and resumes the right stage;
ss-pause-task / ss-archive-task = lifecycle skills that shelve a task as paused
or move it into tasks/archive/, keeping pipeline state intact).
Rules:
- Every skill folder is
ss--prefixed; thestage:/artifacts:values intask.mdare not (spec,plan,coding,review,debug,done). - Maintain shared state in
tasks/TASK-<ID>/: readtask.mdfirst, update it last. - Keep IDs stable (
R#requirement,AC#acceptance criterion,S#step,BUG#); never renumber.ss-codingticksS#in plan.md;ss-reviewticksAC#in spec.md. - Timestamp every log entry as
YYYY-MM-DD HH:MM +TZ(get it fromdate, don't guess). - Follow
docs/onboarding/how-to-code.mdfor code style and placement; runss-explore-sourceto generatedocs/onboarding/*if missing. - Only the pipeline stages and lifecycle skills (
ss-pause-task/ss-archive-task/ss-resume-task) write totasks/. Ask the user before advancing stages (underss-ship, auto-advance instead — stop only on blockers). - Don't run git add / commit / push unless asked.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 27 lines · 446 tokens per session scan A 923165e344b8
WORKFLOW is a cursor rule published in the GitHub repository bonnguyenitc/specship (2 stars, last pushed 24d ago), licensed MIT. It adds 446 tokens to every session, about $0.0022 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
queue
A visible, editable Markdown work queue that agents drain autonomously — one task at a time or fanned out across parallel git worktrees — running each as a quick chore or the full feature-chain (design→prd→tdd→refine) with no user input. Use to queue, prioritize, stop/restart, seed from in-memory items, or…
resume
Resume a checkpointed session from the pushed handoff and continue where it left off. Use on "resume", "pick up where I left off", "continue from the handoff", or starting cold on another device — pulls, reads .pause/handoff.md, and keeps going.
github-issue-creation
Instructions for creating well-structured GitHub issues following best practices and project conventions.
agents
Enforce AGENTS.md (feature chain, MVD, PR workflow).
code-refiner
Composite review-and-fix for the current diff — run the correctness review (validate) and structural-quality review (simplify) in parallel, merge their findings, then apply all fixes in a single serial pass and re-verify. Supports --effort, --fix, --comment. For a full-repo survey use /audit.
statusline
Turn the usage statusLine on or off (model + context% + 5-hour usage% in every project) without editing config by hand. Runs bin/install-statusline.sh, which installs the script to /.claude and merges the setting without clobbering other keys. Opt-in, global, run once per machine; /statusline off disables it.