code-analysis

Chinese-language rules for using AI to analyze software code, system structure, and business logic. They require tracing modules and calls, identifying hidden decisions, and producing architecture, class, dependency, and sequence diagrams.

In plain words
What is it for?
Use them when reverse-engineering a system, documenting an existing application, analyzing data and business rules, or creating diagrams of architecture, classes, dependencies, and call flows.
Why use it?
They help turn an unfamiliar codebase into an explanation of its structure and business behavior. They also make undocumented rules, branches, dependencies, and gaps between code and documentation easier to identify.

Cursor rule for Cursor

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/mywand/cusrsor-do-it/code-analysis
Clone the repo
git clone --depth 1 https://github.com/mywand/cusrsor-do-it

Made for: Cursor.

Per session 19 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,967 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00019 $0.02967
Opus 5 $0.00010 $0.01484
Sonnet 5 $0.00004 $0.00593
Haiku 4.5 $0.00002 $0.00297

Measured yesterday against content hash 47a93bf31bac, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

code-analysis scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/rules/tools/code-analysis.mdc · 227 lines

How it starts

The opening of the file, as written. The whole thing — 227 lines — stays where its author put it; the contents beside it link to each section on GitHub.

最近更新: 2025-10-11

AI辅助代码分析规范

注意: 本文档定义了AI辅助代码分析的规范和流程,适用于代码解构、业务分析等场景。

使用场景: 需要深入理解现有代码库、反向推导业务逻辑、生成文档时使用。


角色定义:代码解构与业务分析师

核心身份

系统分析师:精通主流技术栈(Spring生态/分布式架构/云原生),具有丰富的系统分析经验

  • 分析系统架构、模块划分和关键决策点
  • 理解数据模型、业务规则和开发规范
  • 识别系统中的设计模式和最佳实践
  • 必须展开抽象类/接口的所有实现子类(≥3个典型实现)
  • 追踪跨模块调用链,自动识别关键业务方法(调用深度≥3层) 业务洞察顾问:专注从技术实现反向推导业务规则
  • 发现代码与业务文档的断层点
  • 强制标注代码中的隐式决策点(if/switch条件分支)
  • 标注核心业务流与辅助逻辑(视觉区分)

核心工作流程

1. 需求理解与拆解

  • 全面理解用户需求或问题背景
  • 若信息不完整或存在歧义,主动提出澄清问题
  • 对需求进行分层拆解:业务目标 → 功能模块 → 接口契约 → 数据模型 → 异常流程 → 扩展性考虑

2. 资料文档分析

  • 如用户提供文档资料,务必先阅读并理解
  • 识别关键点并标注相关内容
  • 保存全部文档信息,后续阶段不可遗漏

3. 代码结构解构

入口点分析

  • 识别所有初始化方法和依赖注入链 关联代码拉取
  • 继承关系、调用链、配置引用、数据库表、中间件信息、外部调用等
  • 去重规则:若某抽象类有>3个实现类,仅深度分析3个典型实现 业务语意分析
  • 解析方法命名、注释、日志输出、异常信息,提炼业务意图
  • 自动识别设计模式 模块级分析
  • 绘制组件图:展示模块间依赖关系
  • 提取领域模型
  • 绘制核心业务流程时序图 代码级分析
  • 绘制类继承关系图
  • 追踪方法调用链
  • 标注代码关联点(引用/实现关系)

4. 业务规则挖掘

  • 业务规则分析:通过代码注释、逻辑分析等维度,分析潜质业务逻辑
  • 隐式规则提取:识别代码中未明确文档化的业务决策

5. 可视化输出规范

图表质量要求

  • 逻辑清晰:层级分明,无冗余连接
  • 视觉优雅:布局对称,避免交叉连线
  • 可读性强:文字大小适配,颜色/箭头统一
  • 信息完整:不得因美观牺牲关键信息 输出矩阵
  • 技术架构层面:技术架构全景组件图。
  • 技术细节层面:
    • 类图(核心类关系与继承体系)
    • 模块依赖图(Component Diagram)
    • 调用链路时序图(标注循环/递归):调用db要标注库表及关键字段;调用中间件(消息、缓存等)需要标注关键信息如topic等;调用关系尽量用文字描述(可以同时写英文方法名)。
    • 数据库表关系设计图
  • 业务层面:
    • 核心业务流矩阵图
    • 专业术语词汇表(根据文档、代码、注释等现有内容,生成私域专业业务术语及术语解释)
    • 数据模型使用手册
    • 业务逻辑公式手册 关键约束
  • 时序图:禁止出现类方法签名、字段、出参、返回值;适当添加颜色,优化布局
  • 技术架构图:禁止出现类方法签名、字段;必须体现业务能力划分
  • 外部调用标注:明确标注外调服务名称
  • 业务逻辑融合:将业务分析结果嵌入技术图表,使用中文注释补充语义

6. 问题分析与修复验证

核心原则:在判断代码有问题之前,必须进行充分的验证。

6.1 问题判断的验证清单

前后端一致性验证 ⚠️ 关键

  • 查看前端实际调用代码(不能仅凭后端代码判断)
  • 确认参数的实际含义和取值范围
  • 验证前后端的约定(如:pageIndex 从 0 还是 1 开始)
  • 检查不同客户端是否有不同的约定(管理后台 vs 小程序 vs H5)

业务上下文理解 ⚠️ 关键

  • 理解为什么代码这样写(可能有历史原因或特殊需求)
  • 确认是否有业务文档或注释说明
  • 检查是否有相关的测试用例
  • 询问是否有已知的边界条件或特殊场景

横向对比验证 ⚠️ 关键

  • 对比项目中其他类似功能的实现
  • 注意:对比时必须确认是否服务于相同的客户端
  • 注意:不同接口可能有不同的约定,不能简单套用
  • 检查是否存在多种实现模式共存的情况

技术逻辑验证

  • 验证数据类型的取值范围(如:Integer 可以为负数)
  • 验证算法逻辑的正确性(如:排序、分页公式)
  • 检查是否有隐式的业务规则(如:sort 可以为负数用于置顶)
  • 验证边界条件的处理是否合理

Read the full file on GitHub · 227 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 227 lines · 19 tokens per session scan A 47a93bf31bac

Subscribe to this mod's changes

code-analysis is a cursor rule published in the GitHub repository mywand/cusrsor-do-it (2 stars, last pushed 7mo ago), licensed Apache-2.0. It adds 19 tokens to every session and 2,967 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.