agentmods.dev

code-review-checklist

code-review-checklist is a cursor rule for coding agents from Desko77/cursor-1c-skills. It costs 0 tokens per session (1,000 once invoked), scanned A, original, MIT.

A code-review checklist for 1C source files, including BSL and OS files. It groups findings by severity and checks issues such as security, performance, errors, access control, duplication, and maintainability.

In plain words
What is it for?
Use it when reviewing 1C code for syntax errors, unsafe queries, data risks, missing error handling, slow operations, access problems, complex code, and style issues.
Why use it?
It gives reviewers a consistent way to identify problems and decide which ones block a commit or should be fixed later. It also provides a confidence scale for findings.

Cursor rule

not rated 55 2d ago A scan 0 tokens original MIT
View the source file Desko77/cursor-1c-skills
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/desko77/cursor-1c-skills/code-review-checklist
Clone the repo
git clone --depth 1 https://github.com/Desko77/cursor-1c-skills

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for code-review-checklist

README.md
[![agentmods](https://agentmods.dev/badge/rules/desko77/cursor-1c-skills/code-review-checklist.svg)](https://agentmods.dev/rules/desko77/cursor-1c-skills/code-review-checklist)
Your own site
<a href="https://agentmods.dev/rules/desko77/cursor-1c-skills/code-review-checklist"><img src="https://agentmods.dev/badge/rules/desko77/cursor-1c-skills/code-review-checklist.svg" alt="Measured on agentmods" height="20"></a>
Per session 0 Nothing until a file matches its globs; then the whole rule loads.
When invoked 1,000 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.01000
Opus 5 $0.00000 $0.00500
Sonnet 5 $0.00000 $0.00200
Haiku 4.5 $0.00000 $0.00100

Measured 4d ago against content hash a783d2173e08, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

code-review-checklist scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

rules/code-review-checklist.mdc · 112 lines

How it starts

The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.

1C Code Review Checklist

Применяется: при ревью кода 1С (*.bsl, *.os).

Классификация находок

Critical - блокировать коммит

  • Синтаксические ошибки
  • SQL injection (конкатенация строк в запросе вместо параметров)
  • Риск порчи данных
  • Пробои безопасности (hardcoded пароли, обход RLS)
  • Операции >10с без оптимизации
  • Нарушения БСП с breaking changes

High - исправить до merge

  • Логические ошибки
  • Отсутствие обработки ошибок (пустой Исключение)
  • N+1 запросы (запрос в цикле)
  • Отсутствие индексов на фильтруемых полях
  • Недостаточный контроль доступа (нет проверки прав)
  • Дублирование кода >50 строк
  • Цикломатическая сложность >15 (количество независимых путей выполнения в функции)

Medium - исправить в спринте

  • Нарушение конвенций именования
  • Отсутствие документации экспортных функций
  • Субоптимальные алгоритмы
  • Code smells (God-модуль, длинные функции >200 строк)
  • Незначительные отклонения от БСП
  • Проблемы с тестируемостью

Low - технический долг

  • Форматирование
  • Стиль комментариев
  • Именование переменных
  • Мелкие оптимизации
  • Возможности для рефакторинга

Шкала уверенности

Баллы Уровень Описание
0-25 Низкая Возможно false positive
26-50 Средняя Стоит обсудить
51-75 Высокая Вероятная реальная проблема
76-100 Очень высокая Подтвержденная проблема с доказательствами

Репортить: при ревью кода - только >=75, при ревью архитектуры - >=50.

Фильтр уверенности - цель: отсечь ложные срабатывания:

  • Уверенность подтверждается конкретикой: сценарий сбоя (какие данные/действия ломают код) и подтверждение кодом (файл:строка). Без них оценка не выше средней
  • Находки ниже порога - отбросить или вынести отдельным блоком "Гипотезы (не подтверждены)", не смешивая с основными
  • В отчете находки группировать по severity (Critical -> Low)

Security-паттерны 1С

Уязвимости - искать

  • SQL injection: конкатенация строк в Запрос.Текст вместо &Параметр
  • XSS: неэкранированный вывод в формах
  • Обход RLS: отсутствие проверок ПравоДоступа() / РольДоступна()
  • Hardcoded секреты: пароли, токены, ключи в коде
  • Небезопасная обработка данных: внешние данные без валидации

Read the full file on GitHub · 112 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 112 lines · 0 tokens per session scan A a783d2173e08

Subscribe to this mod's changes

code-review-checklist is a cursor rule published in the GitHub repository Desko77/cursor-1c-skills (55 stars, last pushed 2d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,000 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

1c1c-development1c-edt1c-enterpriseCode reviewai-agentbsl
Related

Other cursor rules, from other repositories

angular-20

This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.

angular/angular · 0 tokens

dev-standard

Apache Superset development standards and guidelines for Cursor IDE.

apache/superset · 1,147 tokens

cli-error-handling

CLI command error handling patterns.

prisma/orm · 0 tokens

prefer-direct-imports-over-module-mocks

Prefer extracting a testable core over vi.mock / vi.resetModules when unit tests need to reach production logic entangled with config, env, or singletons.

prisma/orm · 0 tokens

control-plane-descriptors

Control plane descriptor and instance implementation patterns.

prisma/orm · 0 tokens

family-instance-domain-actions

Family instance domain action implementation patterns.

prisma/orm · 0 tokens