Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/chenychenyu/wl-skills-design/conventionsgit clone --depth 1 https://github.com/ChenyCHENYU/wl-skills-designWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/chenychenyu/wl-skills-design/conventions)<a href="https://agentmods.dev/rules/chenychenyu/wl-skills-design/conventions"><img src="https://agentmods.dev/badge/rules/chenychenyu/wl-skills-design/conventions.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00032 | $0.00720 |
| Opus 5 | $0.00016 | $0.00360 |
| Sonnet 5 | $0.00006 | $0.00144 |
| Haiku 4.5 | $0.00003 | $0.00072 |
Grade C, and why
conventions scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Hidden instructionshighPrompt injection
Directives inside HTML comments, invisible characters or bidirectional overrides are read by the model and not by the person reviewing the file.
<!-- 源文件：.github/copilot-instructions.md --> What it actually says
wl-skills-design 产品设计调度说明
版本：v0.11.1。详细能力按需从 Agent Skill 加载，不要把全部规范注入无关任务。
调度入口
- 读取
.github/skills/_manifest.json，只选择status=released的能力。 - 先判定动作意图：
impact→review→validate→repair→maintain→create。 - 再判定领域；普通代码 review、PR review 和代码重构不得进入产品设计评审。
- 应用 manifest 中的精确词、负向词、优先级和最小领先分差。并列或信息不足时只追问一个关键问题。
- 选定后读取对应
SKILL.md；详细标准、模板和样例只在该 Skill 要求时加载。
执行约束
validate和review默认只读，只输出规则编号、位置、证据和建议。- 只有用户明确要求修复，或正在修复本轮新生成产物时，才可进入
repair。 - 标准文件是规则事实源；Skill 只定义工作流，Prompt 只定义人工快捷入口。
- 缺失业务事实使用
【待补充：说明】，不得编造客户、系统、字段或审批结论。 - 模板不得包含组织名称、项目标识、地点、业务单号或线上业务数据。
- 工作区存在
docs/design-model.json时，优先用稳定 ID 做跨文档集合校验；冲突先报告，不静默覆盖。 - 各包必须独立可用；WL 兼容协议是内置约定而非包依赖。没有 design-model 时不得阻断前后端契约建立。
- 输出必须说明所用 Skill、标准、产物路径、验证结果和暂挂项。
能力索引
requirements-flowchart：draw.io 泳道流程图requirements-prototype：D1–D3 页面与交互标注requirements-spec-doc：需求设计说明书与 IPOdata-database-design：ER、数据字典、DDLapi-interface-design：集成报文与 RESTful 接口cross-glossary：术语、字段、枚举与编码注册cross-design-review：跨文档评审和追溯矩阵cross-change-impact：增量变更影响矩阵和补丁计划doc-intake：半成品文档接入、差距分析和补全任务code-architecture：模块边界、分层依赖、契约和质量门设计
人读索引见 .github/skills/_registry.md，使用说明见 .github/guides/usage.md。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 47 lines · 32 tokens per session scan C 259086e9f4a4
conventions is a cursor rule published in the GitHub repository ChenyCHENYU/wl-skills-design (5 stars, last pushed 21d ago), licensed Apache-2.0. It adds 32 tokens to every session and 720 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 1 finding (hidden instructions). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
cli-error-handling
CLI command error handling patterns.
control-plane-descriptors
Control plane descriptor and instance implementation patterns.
family-instance-domain-actions
Family instance domain action implementation patterns.