Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/gktuoktay/ai-skills/client-securitygit clone --depth 1 https://github.com/GktuOktay/ai-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/gktuoktay/ai-skills/client-security)<a href="https://agentmods.dev/rules/gktuoktay/ai-skills/client-security"><img src="https://agentmods.dev/badge/rules/gktuoktay/ai-skills/client-security.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00837 |
| Opus 5 | $0.00000 | $0.00418 |
| Sonnet 5 | $0.00000 | $0.00167 |
| Haiku 4.5 | $0.00000 | $0.00084 |
Grade A, and why
client-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 72 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Client-Side Security Best Practices
Overview
This skill outlines how to build secure frontend applications by preventing Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), configuring robust Content Security Policy (CSP) headers, ensuring secure cookie usage, and mitigating DOM-based vulnerabilities.
Core Principles
1. Cross-Site Scripting (XSS) Prevention
Never trust data rendered to the DOM.
- Context-aware encoding: Always encode data based on where it will be rendered (HTML body, attributes, JavaScript variables).
- Use modern frameworks: Leverage frameworks like React, Angular, or Vue which automatically escape content by default.
- Avoid dangerous APIs: Avoid using APIs like
innerHTML,document.write(), orv-html/dangerouslySetInnerHTMLunless absolutely necessary and the input is strictly sanitized (e.g., using DOMPurify).
2. Cross-Site Request Forgery (CSRF) Mitigation
Protect state-changing requests from being forged.
- Anti-CSRF Tokens: Implement synchronizer token pattern where every state-changing request (POST, PUT, DELETE) includes a unique, session-tied token.
- SameSite Cookies: Use the
SameSite=LaxorSameSite=Strictflag on all sensitive cookies (e.g., session cookies) to prevent the browser from sending them in cross-site requests.
3. Secure Cookie Flags
Ensure cookies are handled securely by the browser.
- HttpOnly: Prevent client-side scripts from accessing the cookie, mitigating the impact of XSS.
- Secure: Ensure the cookie is only transmitted over HTTPS.
- SameSite: Mitigate CSRF by controlling cross-site cookie sending.
4. Content Security Policy (CSP)
Use CSP to restrict the sources from which resources can be loaded.
- Strict Policies: Implement a strict CSP that relies on nonces or hashes rather than
unsafe-inlineorunsafe-eval. - Report-Only Mode: Deploy CSP in report-only mode first to monitor violations before enforcing.
5. DOM-Based Vulnerabilities
Prevent attacks where the payload is executed as a result of modifying the DOM environment in the victim's browser.
- Avoid sinks: Be cautious with DOM sinks like
location.href,setTimeout,eval(). - Validate sources: Validate data from sources like
location.hash,document.referrer,window.name.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 72 lines · 837 tokens per session scan A dfc80da13d5b
client-security is a cursor rule published in the GitHub repository GktuOktay/ai-skills (2 stars, last pushed 3d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 837 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other cursor rules, from other repositories
figma-translator
Translate any technical specification into five precise, self-contained Figma Make prompts ready to paste and generate.
angular
Angular best practices with standalone components, signals, and modern patterns.
canonical__hhadcn-ui
Cursor rule "canonical__hhadcn-ui" from Bilal140202/the-lord-of-the-skills, covering shadcn/ui best practices, installation, initial setup, initialize shadcn/ui in your project and add components as needed.
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.