Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/eliornl/rolemule/chrome-extensiongit clone --depth 1 https://github.com/eliornl/rolemuleWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.04049 |
| Opus 5 | $0.00000 | $0.02024 |
| Sonnet 5 | $0.00000 | $0.00810 |
| Haiku 4.5 | $0.00000 | $0.00405 |
Grade A, and why
chrome-extension scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 243 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Chrome Extension
Structure
extension/
├── manifest.json # Manifest V3, version 2.0.0
├── popup/ # popup.html, popup.css, popup.js
├── content/ # content.js (extraction), content.css
├── background/ # service-worker.js (token refresh every 55 min)
└── icons/ # icon16/48/128.png (generated from app logo PNG)
Dev / Prod URL Toggle
Both popup.js and service-worker.js use a single flag to switch between local dev and production. Never hardcode PRODUCTION_URL as the active URL.
// ⚠️ BEFORE PUBLISHING: Set IS_DEV = false and fill in PRODUCTION_URL.
const IS_DEV = true;
const DEV_URL = 'http://localhost:8000';
const PRODUCTION_URL = 'https://your-rolemule-instance.com';
const BASE_URL = IS_DEV ? DEV_URL : PRODUCTION_URL;
const CONFIG = {
API_BASE_URL: `${BASE_URL}/api/v1`,
DASHBOARD_URL: `${BASE_URL}/dashboard`,
APP_URL: BASE_URL,
// ...
};
The URL can also be overridden at runtime via chrome.storage.local key jaa_api_url (useful during development):
chrome.storage.local.set({ jaa_api_url: 'http://localhost:8000/api/v1' })
Manifest (current)
- version:
2.0.0 - description: "One mule for every role. Analyze any job posting with AI, or match application forms to your profile."
- short_name:
RoleMule - default_title:
RoleMule — One mule for every role. http://localhost:8000/*is inhost_permissions(required, not optional) so Chrome grants access automatically in dev
Icons
Icons (icon16.png, icon48.png, icon128.png) are generated from the app's logo PNG using Pillow:
cd /path/to/project && source venv/bin/activate
python3 -c "
from PIL import Image
src = 'path/to/logo.png'
img = Image.open(src).convert('RGBA')
for size in [16, 48, 128]:
img.resize((size, size), Image.LANCZOS).save(f'extension/icons/icon{size}.png')
"
Popup Design
The popup (popup.html / popup.css) mirrors the main app's design system exactly:
- Same CSS variables:
--accent-gradient,--bg-primary/secondary/tertiary,--text-*,--border-color, etc. - Same font:
Outfitfrom Google Fonts - Font Awesome 6 loaded from CDN (
cdnjs.cloudflare.com) for all icons — no emoji - Header logo: mule mark (
logo-iconimg fromextension/icons/icon48.png) +Role<span class="brand-accent">Mule</span>(Mule invar(--accent-primary)) - No rounded outer corners — Chrome's native popup window clips them; do not add
border-radiustohtml/body/.popup-container
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 243 lines · 0 tokens per session scan A 89ca8b9d33e1
chrome-extension is a cursor rule published in the GitHub repository eliornl/rolemule (37 stars, last pushed 2d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 4,049 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
real-browser-mcp
Instructions for using Real Browser MCP to control the user's actual browser.
invictum-browser
Use Invictum Browser Bridge whenever the user requests IBB, IBG, Invictum Browser Bridge, or Invictum Browser Gate.
imports-order
Ignore unsorted/unformatted import block linting.
cursorrules
Bridge between MCP protocol and Chrome extensions. Connect AI models to browser capabilities.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.