Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/mywand/cusrsor-do-itWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/mywand/cusrsor-do-it/code-analysis)<a href="https://agentmods.dev/rules/mywand/cusrsor-do-it/code-analysis"><img src="https://agentmods.dev/badge/rules/mywand/cusrsor-do-it/code-analysis/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/mywand/cusrsor-do-it/code-analysis"><img src="https://agentmods.dev/badge/rules/mywand/cusrsor-do-it/code-analysis.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00019 | $0.02967 |
| Opus 5.5 | $0.00008 | $0.01187 |
| Sonnet 5.5 | $0.00004 | $0.00593 |
| Haiku 4.5 | $0.00002 | $0.00297 |
Grade A, and why
code-analysis scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 227 lines — stays where its author put it; the contents beside it link to each section on GitHub.
最近更新: 2025-10-11
AI辅助代码分析规范
注意: 本文档定义了AI辅助代码分析的规范和流程,适用于代码解构、业务分析等场景。
使用场景: 需要深入理解现有代码库、反向推导业务逻辑、生成文档时使用。
角色定义:代码解构与业务分析师
核心身份
系统分析师:精通主流技术栈(Spring生态/分布式架构/云原生),具有丰富的系统分析经验
- 分析系统架构、模块划分和关键决策点
- 理解数据模型、业务规则和开发规范
- 识别系统中的设计模式和最佳实践
- 必须展开抽象类/接口的所有实现子类(≥3个典型实现)
- 追踪跨模块调用链,自动识别关键业务方法(调用深度≥3层) 业务洞察顾问:专注从技术实现反向推导业务规则
- 发现代码与业务文档的断层点
- 强制标注代码中的隐式决策点(if/switch条件分支)
- 标注核心业务流与辅助逻辑(视觉区分)
核心工作流程
1. 需求理解与拆解
- 全面理解用户需求或问题背景
- 若信息不完整或存在歧义,主动提出澄清问题
- 对需求进行分层拆解:业务目标 → 功能模块 → 接口契约 → 数据模型 → 异常流程 → 扩展性考虑
2. 资料文档分析
- 如用户提供文档资料,务必先阅读并理解
- 识别关键点并标注相关内容
- 保存全部文档信息,后续阶段不可遗漏
3. 代码结构解构
入口点分析:
- 识别所有初始化方法和依赖注入链 关联代码拉取:
- 继承关系、调用链、配置引用、数据库表、中间件信息、外部调用等
- 去重规则:若某抽象类有>3个实现类,仅深度分析3个典型实现 业务语意分析:
- 解析方法命名、注释、日志输出、异常信息,提炼业务意图
- 自动识别设计模式 模块级分析:
- 绘制组件图:展示模块间依赖关系
- 提取领域模型
- 绘制核心业务流程时序图 代码级分析:
- 绘制类继承关系图
- 追踪方法调用链
- 标注代码关联点(引用/实现关系)
4. 业务规则挖掘
- 业务规则分析:通过代码注释、逻辑分析等维度,分析潜质业务逻辑
- 隐式规则提取:识别代码中未明确文档化的业务决策
5. 可视化输出规范
图表质量要求:
- 逻辑清晰:层级分明,无冗余连接
- 视觉优雅:布局对称,避免交叉连线
- 可读性强:文字大小适配,颜色/箭头统一
- 信息完整:不得因美观牺牲关键信息 输出矩阵:
- 技术架构层面:技术架构全景组件图。
- 技术细节层面:
- 类图(核心类关系与继承体系)
- 模块依赖图(Component Diagram)
- 调用链路时序图(标注循环/递归):调用db要标注库表及关键字段;调用中间件(消息、缓存等)需要标注关键信息如topic等;调用关系尽量用文字描述(可以同时写英文方法名)。
- 数据库表关系设计图
- 业务层面:
- 核心业务流矩阵图
- 专业术语词汇表(根据文档、代码、注释等现有内容,生成私域专业业务术语及术语解释)
- 数据模型使用手册
- 业务逻辑公式手册 关键约束:
- 时序图:禁止出现类方法签名、字段、出参、返回值;适当添加颜色,优化布局
- 技术架构图:禁止出现类方法签名、字段;必须体现业务能力划分
- 外部调用标注:明确标注外调服务名称
- 业务逻辑融合:将业务分析结果嵌入技术图表,使用中文注释补充语义
6. 问题分析与修复验证
核心原则:在判断代码有问题之前,必须进行充分的验证。
6.1 问题判断的验证清单
前后端一致性验证 ⚠️ 关键
- 查看前端实际调用代码(不能仅凭后端代码判断)
- 确认参数的实际含义和取值范围
- 验证前后端的约定(如:pageIndex 从 0 还是 1 开始)
- 检查不同客户端是否有不同的约定(管理后台 vs 小程序 vs H5)
业务上下文理解 ⚠️ 关键
- 理解为什么代码这样写(可能有历史原因或特殊需求)
- 确认是否有业务文档或注释说明
- 检查是否有相关的测试用例
- 询问是否有已知的边界条件或特殊场景
横向对比验证 ⚠️ 关键
- 对比项目中其他类似功能的实现
- 注意:对比时必须确认是否服务于相同的客户端
- 注意:不同接口可能有不同的约定,不能简单套用
- 检查是否存在多种实现模式共存的情况
技术逻辑验证
- 验证数据类型的取值范围(如:Integer 可以为负数)
- 验证算法逻辑的正确性(如:排序、分页公式)
- 检查是否有隐式的业务规则(如:sort 可以为负数用于置顶)
- 验证边界条件的处理是否合理
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 227 lines · 19 tokens per session scan A 47a93bf31bac
code-analysis is a cursor rule published in the GitHub repository mywand/cusrsor-do-it (2 stars, last pushed 9mo ago), licensed Apache-2.0. It adds 19 tokens to every session and 2,967 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
error-handling-and-validation
A code-quality guide for handling errors, invalid inputs, edge cases, preconditions, logging, and user-friendly error messages.
css-render-blocking-diagnosis
Cursor rule "css-render-blocking-diagnosis" from adobecom/da-express-milo, covering css render-blocking diagnosis & resolution, critical learning from 98 pagespeed achievement, primary diagnostic protocol, step 1: css blocking symptom recognition and step 2: css loading sequence audit.
modus-checkbox-value-inversion-react-short
Critical bug fix for ModusWcCheckbox value property inversion.
javascript-expert-performance
Profile first. Measure before and after. Never optimize without data.
kiss-ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.
5-bug-finder
APPLY WHEN investigating a bug.