Borrowing it
Nothing to install: this file belongs to kings0527/web-reverse-engineering-skill. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/kings0527/web-reverse-engineering-skill/master/.cursorrulesgit clone --depth 1 https://github.com/kings0527/web-reverse-engineering-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/kings0527/web-reverse-engineering-skill/cursorrules)<a href="https://agentmods.dev/rules/kings0527/web-reverse-engineering-skill/cursorrules"><img src="https://agentmods.dev/badge/rules/kings0527/web-reverse-engineering-skill/cursorrules/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/kings0527/web-reverse-engineering-skill/cursorrules"><img src="https://agentmods.dev/badge/rules/kings0527/web-reverse-engineering-skill/cursorrules.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01931 | $0.01931 |
| Opus 5.5 | $0.00772 | $0.00772 |
| Sonnet 5.5 | $0.00386 | $0.00386 |
| Haiku 4.5 | $0.00193 | $0.00193 |
Grade A, and why
cursorrules scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Step 1（curl请求）：正常→L1 | 403→TLS/IP | HTML无数据→需JS How it starts
The opening of the file, as written. The whole thing — 174 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Web Reverse Engineering Skill
核心原则
- Observe-first：先观察再行动，不盲目尝试
- Evidence-based：所有结论基于可验证证据
- Minimum-patch：最小化修补，够用即可
- Layer-by-layer：分层分析，从外到内逐层突破
- Verify-always：每步操作后立即验证
10分钟快速反爬判定
Step 1（curl请求）：正常→L1 | 403→TLS/IP | HTML无数据→需JS Step 2（DevTools）：challenge页→L3 | cookie特征→定性 | JS混淆→评级 Step 3（请求参数）：签名变化→L4 | 自定义Header→加密字段 Step 4（判定）：
| 结果 | 等级 | 方案 |
|---|---|---|
| curl可获取 | L1 | curl_cffi |
| 需简单cookie | L2 | 环境修补 |
| challenge页 | L3 | nodriver/patchright |
| JSVMP+签名 | L4 | VM执行追踪+操作码分析 |
| 全栈+行为 | L5 | 分层击破 |
分析路径
目标网站
├── L1-L2（无/轻度保护）→ curl_cffi + 代理池
├── L3（Challenge页）→ [自动安装WebTrace] detect_protection → hook_api → curl_cffi
├── L4 JSVMP → [强制WebTrace] analyze_jsvmp → hook_api → get_hook_logs → trace_execution
├── L4-L5 WASM → [强制WebTrace] extract_wasm → analyze_wasm → dump_wasm_memory
└── L5（组合保护）→ [强制WebTrace + nodriver] 分层击破
工具选择（强制规则）
| 场景 | 保护等级 | 必须使用 |
|---|---|---|
| TLS/HTTP2指纹 | L1-L2 | curl_cffi |
| 浏览器自动化 | L3+ | nodriver |
| JSVMP分析 | L4+ | WebTrace: analyze_jsvmp + hook_api + trace_execution |
| WASM分析 | L4+ | WebTrace: extract_wasm + analyze_wasm + dump_wasm_memory |
| 动态监控 | L3+ | WebTrace: hook_api + get_hook_logs |
| JS反混淆 | any | webcrack（离线）/ WebTrace: deobfuscate（在线） |
| 网络抓包 | any | mitmproxy / SSLKEYLOGFILE+Wireshark |
| 环境修补 | any | Node.js + Proxy监测法 |
| CDP反检测 | L3+ | nodriver / patchright / rebrowser-patches |
WebTrace 安装与连接（保护等级≥L3时强制执行）
阶段1：构建（大多数Agent可自动完成）
# 检查是否已构建
if [ ! -f "./web-trace/dist/manifest.json" ]; then
git clone --depth 1 https://github.com/kings0527/web-trace.git
cd web-trace && npm install && npm run build
fi
阶段2：加载Extension到浏览器
方式A（自动 - 推荐）：通过nodriver/patchright启动
# Python nodriver（反检测浏览器）
import nodriver as uc
browser = await uc.start(browser_args=['--load-extension=./web-trace/dist'])
方式B（自动 - CLI启动）：直接命令行启动浏览器
# Windows Edge
msedge --load-extension=./web-trace/dist --remote-debugging-port=9222
# Windows Chrome
chrome --load-extension=./web-trace/dist --remote-debugging-port=9222
# 浏览器检测（Windows）
where msedge 2>nul && set BROWSER=msedge || where chrome 2>nul && set BROWSER=chrome
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 174 lines · 1,931 tokens per session scan A 9fa0d5617514
cursorrules is a cursor rule published in the GitHub repository kings0527/web-reverse-engineering-skill (6 stars, last pushed 3mo ago), licensed MIT. It adds 1,931 tokens to every session, about $0.0077 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
vasu-playwright-utils
../../templates/cursor-rules/vasu-playwright-utils.mdc.
chrome-extension-manifest-rules
Specific rules related to the Chrome extension manifest file, ensuring proper structure and content.
vla-registry
Multi-model GUI/VL registry — browser wllama grounding (ShowUI-2B is default + E2E gate).
safari
This file, safari.mdc, serves as a repository for detailed working notes, observations, and learnings acquired during the process of automating Safari interactions, particularly for the MCP Inspector UI. It's intended to capture the nuances of trial-and-error, debugging steps, and insights into what worked, what…
scrapy
Cursor rule "scrapy" from Solihatun1/AI-Cursor-Scraping-Assistant, covering scrapy best practices, 1. code organization and structure, 1.1. directory structure, 1.2. file naming conventions and 1.3. module organization.
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.