Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/imrohit4077/niyamnpx agentmods add rules/imrohit4077/niyam/niyam-conventionsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/imrohit4077/niyam/niyam-conventions)<a href="https://agentmods.dev/rules/imrohit4077/niyam/niyam-conventions"><img src="https://agentmods.dev/badge/rules/imrohit4077/niyam/niyam-conventions/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/imrohit4077/niyam/niyam-conventions"><img src="https://agentmods.dev/badge/rules/imrohit4077/niyam/niyam-conventions.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.04174 | $0.04174 |
| Opus 5.5 | $0.01670 | $0.01670 |
| Sonnet 5.5 | $0.00835 | $0.00835 |
| Haiku 4.5 | $0.00417 | $0.00417 |
Grade A, and why
niyam-conventions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 442 lines — stays where its author put it; the contents beside it link to each section on GitHub.
What is Niyam?
Niyam is a full-stack AI-powered Applicant Tracking System (ATS) — a modern alternative to Greenhouse/Lever/SmartRecruiters.
- Backend: Python 3.11+ · FastAPI · SQLAlchemy 2.0 · PostgreSQL · Alembic migrations
- Frontend: React 19 · TypeScript · Vite · React Router 7 · TipTap editor ·
@dnd-kit - Queue/Async: Celery + Redis (gevent pool)
- PDF generation: WeasyPrint (preferred) with fpdf2 fallback
- Auth: JWT (access + refresh tokens) via
python-jose+ Passlib/bcrypt
Repository Layout
niyam/
├── main.py # FastAPI app factory, middleware, /health
├── manage.py # CLI: runserver, db:*, worker, scheduler, shell, routes
├── requirements.txt
├── pyproject.toml
├── alembic.ini
├── .env.example
│
├── config/
│ ├── routes.py # ← SINGLE place where ALL HTTP routes are registered
│ ├── settings.py # Pydantic Settings (reads .env)
│ ├── database.py # SQLAlchemy engine + session
│ ├── database.yml # Per-env DB config (APP_ENV selects section)
│ ├── celery_app.py # Celery instance
│ └── schedule.py # Celery Beat schedule
│
├── app/
│ ├── controllers/ # HTTP layer: request parsing, auth checks, render_json
│ ├── services/ # Business logic; return {"ok": True/False, ...}
│ ├── models/ # SQLAlchemy ORM models (Mapped / mapped_column)
│ ├── jobs/ # Celery async tasks
│ ├── middleware/ # auth_middleware, audit_log_middleware, logging_middleware
│ ├── schemas/ # Pydantic request/response schemas
│ └── helpers/ # Utilities (object_storage, etc.)
│
├── db/
│ └── migrations/versions/ # Alembic migration files
│
├── web/ # React SPA source
│ ├── src/
│ │ ├── pages/ # Route-level page components
│ │ ├── components/ # Reusable UI components
│ │ ├── hooks/ # Custom React hooks
│ │ ├── api/ # API client functions (fetch wrappers)
│ │ └── types/ # TypeScript types/interfaces
│ └── vite.config.ts # Builds to ../static/; proxies /api → localhost:8000
│
├── static/ # Production SPA bundle (output of npm run build)
├── tests/
└── scripts/
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 442 lines · 4,174 tokens per session scan A 115d6d670e29
niyam-conventions is a cursor rule published in the GitHub repository imrohit4077/niyam (6 stars, last pushed 24d ago), licensed MIT. It adds 4,174 tokens to every session, about $0.0167 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
security-python
Python-side security — XSS sanitization, file upload MIME validation, security headers, global rate limit.
python-conventions
Python coding style, FastAPI endpoint template, code organisation sections.
customer-success-manager
Strategic customer success specialist for onboarding, health scoring, QBR facilitation, churn prevention, expansion identification, and renewal management — driving net revenue retention by turning customers into long-term partners who achieve measurable outcomes.
legal-compliance-checker
Expert legal and compliance specialist ensuring business operations, data handling, and content creation comply with relevant laws, regulations, and industry standards across multiple jurisdictions.
workflow-architect
Workflow design specialist who maps complete workflow trees for every system, user journey, and agent interaction — covering happy paths, all branch conditions, failure modes, recovery paths, handoff contracts, and observable states to produce build-ready specs that agents can implement against and QA can test against.
product-manager
Holistic product leader who owns the full product lifecycle — from discovery and strategy through roadmap, stakeholder alignment, go-to-market, and outcome measurement. Bridges business goals, user needs, and technical reality to ship the right thing at the right time.