Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/kensaurus/cursor-kenji/skill-workflowsgit clone --depth 1 https://github.com/kensaurus/cursor-kenjiWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.02959 | $0.02959 |
| Opus 5 | $0.01479 | $0.01479 |
| Sonnet 5 | $0.00592 | $0.00592 |
| Haiku 4.5 | $0.00296 | $0.00296 |
Grade A, and why
skill-workflows scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 211 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill Routing Index
Bundled workflows (use these first — they chain multiple skills)
| Intent | Workflow skill |
|---|---|
| Build a new feature end-to-end | workflow-build-feature |
| Fix a bug and ship it | workflow-fix-and-ship |
| Pre-release quality check | workflow-quality-gate |
| Local working tree → merge-ready PR (do not merge) | workflow-release-prep |
| Full launch preparation | workflow-launch-ready |
| Orient to a new codebase | workflow-onboard |
| Close post-launch feedback loop | iterate-post-launch |
| Disciplined feature-flag rollout | workflow-feature-flag |
| Finish a partial burndown to 100% coverage | burndown-full |
| Close a plan with no connected deferrals | complete-everything |
| Green the whole repository (authorized debt cleanup) | workflow-green-repo |
| Deploy to production and watch it | workflow-ship-and-observe |
| Turn feedback into tracked, verified-closed tickets | workflow-feedback-to-closure |
| Preflight the environment before a long run | workflow-environment-ready |
| Turn an agent failure into a durable guard | iterate-agent-harness |
complete-everything and burndown-full are explicit closure modes: persist
their state files and continue through phase checkpoints. Before either claims
completion, apply verification-before-completion and invoke the
completion-judge subagent. The packaged Cursor stop hook continues only
actionable unchecked state; Claude Code 2.1.139+ can enforce the same condition
with /goal.
When to use a bundled workflow vs individual skill
- Use a bundle when the user's request spans multiple phases (spec + build + test, or launch + verify + iterate)
- Use an individual skill when the request is scoped to one phase ("just run the security audit", "just write tests", "just write the PR")
- Bundles call individual skills — they never duplicate instructions; they sequence them
Individual skill quick-reference
Testing & quality
| Task | Skill |
|---|---|
| Adversarial full-app sweep | test-red-team |
| Drive app as real user, fix inline | test-playwright |
| Comprehensive QA with CRUD verification | test-qa |
| Unscripted guest vs logged-in wander + diff | test-exploratory |
| Write unit/integration tests | test-unit |
| Mutation testing — do tests actually assert? | test-mutation |
| Screenshot baselines / CI pixel diffs | test-visual-regression |
| k6/Artillery breaking point (never unsigned prod) | test-load |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 211 lines · 2,959 tokens per session scan A ab91ea89aad6
skill-workflows is a cursor rule published in the GitHub repository kensaurus/cursor-kenji (9 stars, last pushed 3d ago), licensed MIT. It adds 2,959 tokens to every session, about $0.0148 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
composer-coding-excellence
Coding craft — surgical edits, convention matching, no scope creep, no slop comments, no fabricated APIs.
composer-core
Always-on builder spine — continue the app, demoable slice, Build loop, Run/Wired handoff, ask only on high confusion weight.
composer-reasoning
High-stakes judgment for architectural or multi-option work — tradeoffs, one-way doors, reason-then-re-evaluate, honest pushback.
clarify-first
Infer-and-act by default — ask only on high confusion weight, after inspecting, with a decision-linked question.
composer-orchestration
Subagents, plan mode, parallel workstreams, long-running tasks — when to delegate vs do inline.
composer-debugging
Root-cause debugging — reproduce, trace data flow, test cheapest hypothesis, fix the cause not the symptom.