Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/contentstack/contentstack-agent-skills/21-migration-companiongit clone --depth 1 https://github.com/contentstack/contentstack-agent-skillsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00155 | $0.11048 |
| Opus 5 | $0.00077 | $0.05524 |
| Sonnet 5 | $0.00031 | $0.02210 |
| Haiku 4.5 | $0.00015 | $0.01105 |
Grade B, and why
21-migration-companion scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
> (e.g. `brew install python3` on macOS, `sudo apt install python3` on Ubuntu, How it starts
The opening of the file, as written. The whole thing — 951 lines — stays where its author put it; the contents beside it link to each section on GitHub.
contentstack-migration-companion
Guide a user through migrating a project from Contentful to Contentstack — first the content (content types, entries, assets, locales) via the Contentstack CLI migrate plugin, then the website code that reads from the CMS.
This is a sequential workflow where each step produces output that the next step consumes (the create command produces a populated stack and a bundle with credentials, which feeds the code migration). Treat the artifact paths and counts that each command prints as state you must capture and carry forward.
Operating principles
Follow these throughout — they matter more than any single command:
- Work in a unique session workspace. At the very start of Step 1, create a
session-scoped directory by running:
Record the printedSESSION_ID=$(date +%Y%m%d-%H%M%S) && SESSION_DIR="/tmp/migrate-to-cs/$SESSION_ID" && mkdir -p "$SESSION_DIR" && echo "SESSION_DIR=$SESSION_DIR"SESSION_DIRvalue (e.g./tmp/migrate-to-cs/20260608-143022) and carry it as a concrete literal through every shell command in this migration — do not regenerate it. This keeps each migration run isolated so concurrent sessions and re-runs never collide. If the user points you to a different workspace, use their path instead. - Bundled scripts & references live next to this skill — resolve them via
{SKILL_DIR}. This skill ships helper scripts (ascripts/folder) and reference docs (areferences/folder) alongside thisSKILL.mdfile. Wherever these instructions write{SKILL_DIR}, substitute the absolute path of the directory thisSKILL.mdwas loaded from — i.e. the skill's own install directory. Do not assume a fixed path. The location differs by AI assistant, by OS, and by whether the skill was installed per-project or per-user — for example it may be<project>/.claude/skills/contentstack-migration-companion,~/.claude/skills/contentstack-migration-companion, or a Windows path like%USERPROFILE%\.claude\skills\contentstack-migration-companion. Determine the real path once (it is the folder you read thisSKILL.mdfrom; if unsure, search the workspace and home directory for*/contentstack-migration-companion/SKILL.md), and for shell commands set it as a variable up front (SKILL_DIR="<that absolute path>") so bundled scripts can be invoked as"$SKILL_DIR/scripts/<name>". The bundled scripts self-locate their own siblings, so once you invoke them by absolute path they work regardless of your current directory. - Pin the Node version for the whole session. A machine often has several Node versions
(system, Homebrew, multiple nvm installs) and a non-interactive shell may resolve an old one
(e.g.
/usr/local/bin/nodev14) ahead of the user's nvm default. The Step 1 prereq checker finds the highest installed Node ≥ 20 and reports its directory asnode.bin_dirin the JSON. Record that value as a concrete literalNODE_BIN_DIRand prefix everycsdx,npm, andcontentfulcommand for the rest of the migration with it, e.g.PATH="<NODE_BIN_DIR>:$PATH" csdx migrate:create …. This guarantees the CLI runs on the Node the prereq check validated, not whatever an unconfigured shell picks first. Ifnode.bin_diris absent (older check output), fall back to the plain command. - One step at a time, and show the result. After each command, surface the meaningful output to the user — the summary tables, the counts, the artifact path — not a wall of raw logs. The user is watching this like a progress bar; give them a clean status, then the path/handle the next step needs.
- Track migration progress with the checklist. At each
[PROGRESS]trigger below, output a progress block in your response using these emoji:✅= completed,⏳= currently running,⬜= not yet started. Example for Step 3 in progress:
Output it at two moments: (1) at the start of each step, and (2) when each step's eval passes. Only one step is**Migration progress** - ✅ Step 1 — Prerequisites & inputs - ✅ Step 2 — Install migrate plugin - ⏳ Step 3 — Content Migration - ⬜ Step 4 — Code Migration⏳at a time. Step 4 stays⏳through all sub-steps 4.1–4.6. Step 5 (Welcome) is not tracked — it triggers automatically once Step 4 is ✅. - Gate the destructive or expensive steps. Confirm before logging in, before creating a new stack, and before editing the user's code. These either touch live accounts or modify their repo, so a quick "ready to proceed?" prevents nasty surprises.
- Capture the outputs explicitly. When a command prints a bundle path, a log directory, or a stack API key, record the exact path/value and reuse it verbatim. Do not guess paths — read them back from the command output.
- Browser-based login is normal here.
csdx auth:login --oauthopens the user's browser; the terminal then blocks and auto-detects when they finish. Run it, tell the user to complete login in the browser, and simply wait for the command to return — do not try to script the browser or kill the command. - Currently Contentful is the only supported source. Do not ask the user which legacy
platform they're on; assume Contentful. (The CLI flag is
--source contentful.) - If a step fails, stop and diagnose rather than barrelling ahead. Most failures here are recoverable (expired token → re-login, missing content model → inform the user), and the relevant recovery is described in the step that can fail.
- Never display code in your text output. Do not show shell commands, code snippets, scripts, or any fenced code blocks (``` blocks) in your chat messages at any point during the migration. Just run commands silently and report the result in plain prose. The user sees tool calls in the tool panel — repeating code in chat is noise.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 951 lines · 155 tokens per session scan B 6c4a4358b0f9
21-migration-companion is a cursor rule published in the GitHub repository contentstack/contentstack-agent-skills (5 stars, last pushed 15d ago), licensed MIT. It adds 155 tokens to every session and 11,048 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
typescript
Changes to these high-fan-out internals can affect every message, delta, element, or rerun. Keep work in them minimal, and benchmark changes with representative stress-test apps.
coolify-ai-docs
Master reference to all Coolify AI documentation in .ai/ directory.
python_lib
Tips and guidelines specific to the development of the Streamlit Python library, not applicable to scripts and e2e tests.
specs
This directory contains product and tech specs for Streamlit features.