Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/chihebnabil/lovable-boilerplate/componentsgit clone --depth 1 https://github.com/chihebnabil/lovable-boilerplateWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00813 |
| Opus 5 | $0.00000 | $0.00407 |
| Sonnet 5 | $0.00000 | $0.00163 |
| Haiku 4.5 | $0.00000 | $0.00081 |
Grade A, and why
components scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 144 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Component Development Rules
Component Patterns
GOOD Component Structure
// Single responsibility, 20-80 lines
interface UserCardProps {
user: User
onEdit: (id: string) => void
className?: string
}
export const UserCard = ({ user, onEdit, className }: UserCardProps) => {
return (
<Card className={cn("p-4", className)}>
<Avatar src={user.avatar} />
<div>
<h3 className="font-semibold">{user.name}</h3>
<p className="text-muted-foreground">{user.email}</p>
<Button onClick={() => onEdit(user.id)}>Edit</Button>
</div>
</Card>
)
}
AVOID: Monolithic Components
// DON'T: 300+ lines mixing concerns
const UserManagement = () => {
// Massive component with multiple responsibilities
}
Component Composition Pattern
// Build complex UI from smaller components
const Dashboard = () => (
<PageLayout>
<DashboardHeader />
<DashboardMetrics />
<DashboardCharts />
<DashboardActivity />
</PageLayout>
)
UI Component Rules
shadcn/ui Components
- NEVER modify files in
src/components/ui/directly - EXTEND by creating wrappers in
src/components/common/ - COMPOSE multiple ui components to build features
Form Components
// Use React Hook Form + Zod pattern
export const UserForm = ({ onSubmit, initialData }: UserFormProps) => {
const form = useForm<UserFormData>({
resolver: zodResolver(userSchema),
defaultValues: initialData
})
return (
<Form {...form}>
<form onSubmit={form.handleSubmit(onSubmit)}>
<FormField
control={form.control}
name="name"
render={({ field }) => (
<FormItem>
<FormLabel>Name</FormLabel>
<FormControl>
<Input {...field} />
</FormControl>
<FormMessage />
</FormItem>
)}
/>
</form>
</Form>
)
}
Page Component Rules
Pages = Composition Only
// PERFECT: Thin orchestration layer (10-30 lines max)
const DashboardPage = () => {
const { data: user, isLoading } = useCurrentUser()
if (isLoading) return <PageSkeleton />
return (
<PageLayout>
<DashboardHeader user={user} />
<DashboardMetrics />
<div className="grid grid-cols-1 lg:grid-cols-2 gap-6">
<DashboardCharts />
<DashboardActivity />
</div>
</PageLayout>
)
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 144 lines · 0 tokens per session scan A 26a15e89d2ce
components is a cursor rule published in the GitHub repository chihebnabil/lovable-boilerplate (65 stars, last pushed 1mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 813 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
library-conventions
React Native library conventions for this starter. Apply when creating or editing components, hooks, types, or tests in src/.
ai-collaboration
Instructions for AI agent code generation workflow.
api-validation
API route validation — enforces Zod validation on all route handlers and server actions.
error-handling
Error boundaries, loading states, and server error handling.
file-uploads
Image and file upload patterns — prevents insecure client-side uploads and missing file validation.
security
Security rules and OWASP Top 10 enforcement for AI-generated code.