Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/davis7dotsh/riverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/davis7dotsh/river/svelte)<a href="https://agentmods.dev/rules/davis7dotsh/river/svelte"><img src="https://agentmods.dev/badge/rules/davis7dotsh/river/svelte/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/davis7dotsh/river/svelte"><img src="https://agentmods.dev/badge/rules/davis7dotsh/river/svelte.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.06762 |
| Opus 5.5 | $0.00000 | $0.02705 |
| Sonnet 5.5 | $0.00000 | $0.01352 |
| Haiku 4.5 | $0.00000 | $0.00676 |
Grade C, and why
svelte scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Hidden instructionshighPrompt injection
Directives inside HTML comments, invisible characters or bidirectional overrides are read by the model and not by the person reviewing the file.
- **Comments:** `<!-- HTML comment -->`. `<!-- svelte-ignore directive -->`. `<!-- @component Doc comment -->`. How it starts
The opening of the file, as written. The whole thing — 474 lines — stays where its author put it; the contents beside it link to each section on GitHub.
- always use typescript, the script should be
- use svelte 5 (runes, snippets, etc.) syntax
- use remote functions where you can, they are the preferred way to fetch data from the server
- use the new async svelte features when it makes sense to with
<svelte:boundary>andawait. it's very similar to how suspense works in react - if you need to use lucide icons, you can import them from @lucide/svelte (
<script> import { Skull } from '@lucide/svelte'; </script>)
Svelte 5 Migration Guide
[!NOTE] Svelte 5 Migration Changes
For a comprehensive migration guide, see: https://svelte.dev/docs/svelte/v5-migration-guide/llms.txt
Key Changes:
- Runes API: Replaced implicit reactivity (
$:) with explicit runes ($state,$derived,$effect)- Props: Changed from
export letto$props()rune with destructuring- Events: Changed from
on:clicktoonclick(no colon)- Event Modifiers: Event modifiers are no longer supported. Instead of
<button on:click|once|preventDefault={handler}>, useonclickand handle modifiers in the handler function- Slots to Snippets: Replaced
<slot>with{#snippet}and{@render}- Actions: Replaced
use:directive with@attach- Component API: Components are now functions instead of classes
- Two-way Binding: Requires explicit
$bindablerune for bindable props- Server Rendering: Components no longer have
render()method; userender()fromsvelte/serverfor SSR
svelte 5 docs:
Core Principles & Setup:
- Svelte 5 Mandate:
MUSTuse Svelte 5 API (Runes). Unchanged syntax ({#if}) reused from S4 knowledge. - Runes Overview: Built-in keywords (
$) controlling compiler.CORRECT: Use as language keywords. AVOID: Importing/calling runes like functions.Valid in.svelte,.svelte.js,.svelte.tsfiles. .svelteFiles: Optional<script>,<script module>,<style>, markup sections.<script>: Runs per component instance. Use runes here.<script module>: Runs once per module load. Can export non-default bindings. Variables accessible in instance script, not vice-versa.<style>: CSS scoped to the component by default.
.svelte.js/.svelte.tsFiles: Regular JS/TS modules supporting runes for reactive logic/state sharing.// store.svelte.js export let count = $state(0); // Export reactive state export const increment = () => count++;- DOM Event Syntax:
USE onclick={...} (Replaces S4 on:click={...}).No colon.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 474 lines · 6,762 tokens per session scan C 730c6f74f8eb
svelte is a cursor rule published in the GitHub repository davis7dotsh/river (228 stars, last pushed 7mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 6,762 tokens. A static security scan graded it C with 1 finding (hidden instructions). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
svelte
You are an expert in Svelte 5, SvelteKit, TypeScript, and modern web development.
vue-typescript-patterns
A set of coding rules for Vue 3 projects using TypeScript, a language that adds type checking to JavaScript. It covers component structure, file locations, TypeScript usage, and Pinia, a library for shared application state.
project-overview
A project overview for a uni-app application built with Vue 3, TypeScript, Vite, and UnoCSS. It explains the supported platforms, main folders, configuration files, and development commands.
frontend
You are an expert in TypeScript, Node.js, Vite, Vue.js, Vue Router, Pinia, VueUse, Ant Design Vue, and UnoCSS, with a deep understanding of best practices and performance optimization techniques in these technologies.
sveltekit-tailwindcss-typescript-cursorrules-promp
Cursor rules for SvelteKit development with Tailwind CSS and TypeScript integration.
code
A set of coding rules for Vue 3 components written with TypeScript. It covers component structure, typed properties and events, reusable composables, and stylesheet conventions.