Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/duckduckgo/apple-browsers/pixelsgit clone --depth 1 https://github.com/duckduckgo/apple-browsersWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00016 | $0.03077 |
| Opus 5 | $0.00008 | $0.01538 |
| Sonnet 5 | $0.00003 | $0.00615 |
| Haiku 4.5 | $0.00002 | $0.00308 |
Grade A, and why
pixels scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 330 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Pixels
Pixels are one-off telemetry events sent via HTTP GET with a name and optional parameters. They are used for:
- Basic feature usage events (e.g., button clicks, screen impressions)
- Errors (e.g., network failures, parsing errors)
- Conversion and retention (e.g, subscription purchase and activation)
Pixels have the following requirements:
- Use clear & transparent naming, so it's obvious what the pixel and parameters are for. Pixel names should be self-documenting - avoid cryptic abbreviations or shorthand.
- Only include information that is essential for the pixel
- Do not use values that are overly precise, e.g. if using an integer value in a parameter, bucket it into ranges rather than including the value verbatim
- Never include PII, URLs, or other forms of user-identifiable information in pixel names or parameters
For new production iOS code, use PixelKit instead of the legacy iOS Pixel, DailyPixel, UniquePixel, TimedPixel, or PersistentPixel APIs. Danger exempts only the legacy infrastructure files named by its check, plus test and mock files; these exemptions do not apply to other production code.
Types of Pixels
Standard Pixels
Sent every time the event occurs.
pixelKit.fire(event)
pixelKit.fire(event, options: .parameters(["source": "manual"]))
Daily Pixels
Sent once per day per event. PixelKit appends _daily to the event name. Used to determine the number of users affected by a particular error.
pixelKit.fire(event, frequency: .daily)
Unique Pixels
Sent once per install for the lifetime of the install. The event name must end with _u.
pixelKit.fire(uniqueEvent, frequency: .uniqueByName)
Pixel Definition Patterns
Legacy iOS Pixels
Existing legacy iOS pixels are defined as cases on Pixel.Event in iOS/Core/PixelEvent.swift. Each enum case maps to an HTTP pixel name string via a computed name property. This section is reference material for that existing system only.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 330 lines · 16 tokens per session scan A c67023da13b5
pixels is a cursor rule published in the GitHub repository duckduckgo/apple-browsers (252 stars, last pushed today), licensed Apache-2.0. It adds 16 tokens to every session and 3,077 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-01.
Other cursor rules, from other repositories
utilities
Lodash 和 Moment.js 工具庫使用規範.
create-ios-release
As an AI assistant helping with iOS app releases, I should guide through the following process for successfully deploying iOS applications to the App Store.
knowledge-management-rule
Comprehensive knowledge management system for capturing, organizing, and applying project knowledge.
203-healthkit-integration-detailed
HealthKit & WorkoutKit 集成规范 - 详细参考.
010-healthkit-workoutkit
010: HealthKit and WorkoutKit integration patterns for iOS health apps.
main-refactoring-rules
ios cursor rules.