Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/davis7dotsh/river/sveltegit clone --depth 1 https://github.com/davis7dotsh/riverWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.06762 |
| Opus 5 | $0.00000 | $0.03381 |
| Sonnet 5 | $0.00000 | $0.01352 |
| Haiku 4.5 | $0.00000 | $0.00676 |
Grade C, and why
svelte scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Hidden instructionshighPrompt injection
Directives inside HTML comments, invisible characters or bidirectional overrides are read by the model and not by the person reviewing the file.
- **Comments:** `<!-- HTML comment -->`. `<!-- svelte-ignore directive -->`. `<!-- @component Doc comment -->`. How it starts
The opening of the file, as written. The whole thing — 474 lines — stays where its author put it; the contents beside it link to each section on GitHub.
- always use typescript, the script should be
- use svelte 5 (runes, snippets, etc.) syntax
- use remote functions where you can, they are the preferred way to fetch data from the server
- use the new async svelte features when it makes sense to with
<svelte:boundary>andawait. it's very similar to how suspense works in react - if you need to use lucide icons, you can import them from @lucide/svelte (
<script> import { Skull } from '@lucide/svelte'; </script>)
Svelte 5 Migration Guide
[!NOTE] Svelte 5 Migration Changes
For a comprehensive migration guide, see: https://svelte.dev/docs/svelte/v5-migration-guide/llms.txt
Key Changes:
- Runes API: Replaced implicit reactivity (
$:) with explicit runes ($state,$derived,$effect)- Props: Changed from
export letto$props()rune with destructuring- Events: Changed from
on:clicktoonclick(no colon)- Event Modifiers: Event modifiers are no longer supported. Instead of
<button on:click|once|preventDefault={handler}>, useonclickand handle modifiers in the handler function- Slots to Snippets: Replaced
<slot>with{#snippet}and{@render}- Actions: Replaced
use:directive with@attach- Component API: Components are now functions instead of classes
- Two-way Binding: Requires explicit
$bindablerune for bindable props- Server Rendering: Components no longer have
render()method; userender()fromsvelte/serverfor SSR
svelte 5 docs:
Core Principles & Setup:
- Svelte 5 Mandate:
MUSTuse Svelte 5 API (Runes). Unchanged syntax ({#if}) reused from S4 knowledge. - Runes Overview: Built-in keywords (
$) controlling compiler.CORRECT: Use as language keywords. AVOID: Importing/calling runes like functions.Valid in.svelte,.svelte.js,.svelte.tsfiles. .svelteFiles: Optional<script>,<script module>,<style>, markup sections.<script>: Runs per component instance. Use runes here.<script module>: Runs once per module load. Can export non-default bindings. Variables accessible in instance script, not vice-versa.<style>: CSS scoped to the component by default.
.svelte.js/.svelte.tsFiles: Regular JS/TS modules supporting runes for reactive logic/state sharing.// store.svelte.js export let count = $state(0); // Export reactive state export const increment = () => count++;- DOM Event Syntax:
USE onclick={...} (Replaces S4 on:click={...}).No colon.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 474 lines · 6,762 tokens per session scan C 730c6f74f8eb
svelte is a cursor rule published in the GitHub repository davis7dotsh/river (227 stars, last pushed 5mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 6,762 tokens. A static security scan graded it C with 1 finding (hidden instructions). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
svelte
You are an expert in Svelte 5, SvelteKit, TypeScript, and modern web development.
cursorrules
Comprehensive Testing Best Practices for Svelte 5 + vitest-browser-svelte.
testing
Comprehensive Testing Best Practices for Svelte 5 + vitest-browser-svelte.
project
Open Electricity project rules.
cursorrules
Read and follow AGENTS.md before making changes. It is the canonical, model-neutral source for project commands, Svelte 5 conventions, testing, API design, and git safety. Task-specific procedures are in docs/agent-workflows/.
best-practices
SvelteKit Best Practices - enforces current best practices when working with SvelteKit / Svelte 5 code.