Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/lastbotinc/cursor-rules-tools/command_line_toolsgit clone --depth 1 https://github.com/LastBotInc/cursor-rules-toolsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.04606 | $0.04606 |
| Opus 5 | $0.02303 | $0.02303 |
| Sonnet 5 | $0.00921 | $0.00921 |
| Haiku 4.5 | $0.00461 | $0.00461 |
Grade A, and why
command_line_tools scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 373 lines — stays where its author put it; the contents beside it link to each section on GitHub.
<command_line_tools>
Project-Specific Tools: Execute these using run_terminal_cmd.
🔧 Setup: Run npm install and configure API keys in .env.local (see .env.example)
{ "tools": { "image-optimizer": { "description": "Optimizes images with background removal, resizing, and format conversion using Sharp and Replicate's remove-bg model", "tool": "run_terminal_cmd", "command": "npm run optimize-image", "status": "✅ Tested and working", "options": { "input": "Path to input image", "output": "Path to output image", "remove-bg": "(Optional) Remove image background using AI", "resize": "(Optional) Resize image (format: WIDTHxHEIGHT, e.g. 800x600)", "format": "(Optional) Convert to format (png, jpeg, or webp)", "quality": "(Optional) Set output quality (1-100, default: 80)" }, "requires": [ "REPLICATE_API_TOKEN in .env.local (for background removal)", ], "example": "npm run optimize-image -- -i input.png -o output.webp --resize 512x512 --format webp --quality 90", "note": "Use -i and -o flags for input/output. Background removal requires Replicate API token." }, "html-to-md": { "description": "Scrapes a webpage and converts its HTML content to Markdown format using Turndown service", "tool": "run_terminal_cmd", "command": "npm run html-to-md", "status": "✅ Tested and working", "options": { "url": "URL of the webpage to scrape", "output": "(Optional) Output file path for the markdown (default: output.md)", "selector": "(Optional) CSS selector to target specific content" }, "requires": [ ], "example": "npm run html-to-md -- --url https://example.com --output docs/scraped.md --selector main" }, "gemini": { "description": "Interacts with Google's Gemini API for text generation, chat, multimodal tasks, document analysis, and grounded search", "tool": "run_terminal_cmd", "command": "npm run gemini", "status": "✅ Tested and working", "options": { "prompt": "Text prompt or question for the model", "model": "(Optional) Model to use: 'gemini-2.0-flash' (default), 'gemini-2.5-pro-exp-03-25'", "temperature": "(Optional) Sampling temperature between 0.0 and 1.0 (default: 0.7)", "max-tokens": "(Optional) Maximum tokens to generate (default: 2048)", "image": "(Optional) Path to image file for vision tasks", "file": "(Optional) Path to local file (PDF, DOCX, TXT, etc.) for document analysis", "url": "(Optional) URL to a document to analyze (PDF, DOCX, TXT, etc.)", "mime-type": "(Optional) MIME type of the file (e.g., application/pdf, default: auto-detected)", "chat-history": "(Optional) Path to JSON file containing chat history", "stream": "(Optional) Stream the response (default: false)", "safety-settings": "(Optional) JSON string of safety threshold configurations", "schema": "(Optional) JSON schema for structured output", "json": "(Optional) Return structured JSON data. Available types: recipes, tasks, products, custom", "ground": "(Optional) Enable Google Search grounding for up-to-date information (default: false)", "show-search-data": "(Optional) Show the search entries used for grounding (default: false)" }, "requires": [ "GOOGLE_AI_STUDIO_KEY or GEMINI_API_KEY in .env.local", "@google/generative-ai package (auto-installed with npm install)", "node-fetch package (auto-installed with npm install)"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 373 lines · 4,606 tokens per session scan A 7e939218b8bd
command_line_tools is a cursor rule published in the GitHub repository LastBotInc/cursor-rules-tools (3 stars, last pushed 1y ago), licensed MIT. It adds 4,606 tokens to every session, about $0.0230 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
webkit-browser
Cursor rule "webkit-browser" from duckduckgo/apple-browsers, covering webkit & browser development guidelines, webview configuration, basic webview setup, user scripts management and tab management.
cypress-e2e-testing-cursorrules-prompt-file
Cursor rules for Cypress development with E2E testing.
vasu-playwright-utils
../../templates/cursor-rules/vasu-playwright-utils.mdc.
dev-browser
Fallback browser automation with persistent Chrome state. Use only when Browser Use is unavailable or blocked.
node-dependencies
Enforce Node.js versioning and package management best practices.
security-standards
Cursor rule "security-standards" from wjgogogo/cursor-rules, covering 安全规范, 核心原则 [p0], 输入验证, xss 防护 and csrf 防护.