Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/mr-chen-05/rules-2.1-optimized/audit-logging-systemgit clone --depth 1 https://github.com/Mr-chen-05/rules-2.1-optimizedWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/mr-chen-05/rules-2.1-optimized/audit-logging-system)<a href="https://agentmods.dev/rules/mr-chen-05/rules-2.1-optimized/audit-logging-system"><img src="https://agentmods.dev/badge/rules/mr-chen-05/rules-2.1-optimized/audit-logging-system.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.04984 | $0.04984 |
| Opus 5 | $0.02492 | $0.02492 |
| Sonnet 5 | $0.00997 | $0.00997 |
| Haiku 4.5 | $0.00498 | $0.00498 |
Grade A, and why
audit-logging-system scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 608 lines — stays where its author put it; the contents beside it link to each section on GitHub.
📊 审计日志系统
全面审计: 记录所有关键操作和安全事件，提供完整的审计追踪能力
🎯 系统概述
审计日志系统为规则系统提供完整的操作追踪和安全监控：
- 操作审计: 记录所有文件操作和系统变更
- 安全事件: 追踪权限检查和异常行为
- 性能监控: 记录性能指标和资源使用
- 合规支持: 满足审计和合规要求
📋 日志级别
日志级别定义:
CRITICAL (严重):
- 安全违规事件
- 系统崩溃错误
- 数据损坏事件
- 权限突破尝试
- 敏感信息泄露
示例:
[CRITICAL] 2025-10-18 10:30:00 | 检测到敏感信息泄露尝试
操作者: AI Agent
目标文件: project.context.md
敏感类型: API密钥
处理结果: 已阻止并脱敏
审计追踪: audit-2025-10-18-001
WARNING (警告):
- 风险操作执行
- 性能降级事件
- 资源接近上限
- 配置不当警告
- 重试次数过多
示例:
[WARNING] 2025-10-18 10:35:00 | 用户确认风险操作
操作类型: 删除归档文件
风险等级: HIGH
用户确认: 是
影响范围: 5个归档文件
审计追踪: audit-2025-10-18-002
INFO (信息):
- 正常操作记录
- 状态变更事件
- 配置更新记录
- 用户指令执行
- 系统启动/关闭
示例:
[INFO] 2025-10-18 10:40:00 | 项目记忆文件更新
操作者: AI Agent
文件路径: project.context.md
变更类型: 添加TODO项
变更大小: +120字节
耗时: 0.3秒
DEBUG (调试):
- 详细调试信息
- 内部状态记录
- 性能分析数据
- 开发诊断信息
- 变量追踪记录
示例:
[DEBUG] 2025-10-18 10:45:00 | 缓存查询命中
缓存类型: MCP检测缓存
缓存键: mcp-detection-cursor
命中率: 95%
响应时间: 2ms
📝 记录内容
1. 操作日志 (Operation Log)
操作日志结构:
基本信息:
- 时间戳: ISO 8601格式 (2025-10-18T10:30:00.123Z)
- 日志级别: CRITICAL/WARNING/INFO/DEBUG
- 操作类型: 文件操作/系统配置/用户交互等
- 操作者: User/AI Agent/System
- 会话ID: 唯一会话标识符
详细信息:
- 操作目标: 文件路径/配置项/系统组件
- 操作内容: 具体执行的操作
- 影响范围: 受影响的资源
- 执行结果: 成功/失败/部分成功
- 错误信息: 失败时的详细错误
性能指标:
- 开始时间: 操作开始时间戳
- 结束时间: 操作结束时间戳
- 耗时: 毫秒级精度
- 资源使用: CPU/内存/磁盘IO
审计信息:
- 审计追踪ID: 唯一审计标识
- 关联操作: 相关的前序操作
- 风险等级: LOW/MEDIUM/HIGH/CRITICAL
- 合规标签: 合规要求标记
日志格式 (JSON):
{
"timestamp": "2025-10-18T10:30:00.123Z",
"level": "INFO",
"type": "file_operation",
"operator": "AI Agent",
"session_id": "sess-20251018-001",
"operation": {
"action": "update",
"target": "project.context.md",
"section": "TODO",
"content_size": 120,
"backup_created": true
},
"result": {
"status": "success",
"duration_ms": 350,
"affected_lines": 5
},
"audit": {
"trace_id": "audit-2025-10-18-001",
"risk_level": "LOW",
"compliance": ["data-integrity"]
}
}
日志格式 (文本):
[INFO] 2025-10-18 10:30:00.123 | file_operation | AI Agent | sess-20251018-001
Action: update project.context.md (TODO section)
Content: +120 bytes, 5 lines affected
Result: SUCCESS (350ms)
Audit: audit-2025-10-18-001 [LOW risk] [data-integrity]
Backup: .backups/project.context.md.20251018_103000.bak
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 608 lines · 4,984 tokens per session scan A face6c8bcd02
audit-logging-system is a cursor rule published in the GitHub repository Mr-chen-05/rules-2.1-optimized (172 stars, last pushed 10mo ago), licensed MIT. It adds 4,984 tokens to every session, about $0.0249 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
cli-error-handling
CLI command error handling patterns.
prefer-direct-imports-over-module-mocks
Prefer extracting a testable core over vi.mock / vi.resetModules when unit tests need to reach production logic entangled with config, env, or singletons.
control-plane-descriptors
Control plane descriptor and instance implementation patterns.
family-instance-domain-actions
Family instance domain action implementation patterns.