A set of baseline rules for software projects, including coding, documentation, logging, security, performance, and checks after changes. The input states that responses using this rule should be in Simplified Chinese, while technical terms may remain in English.

Use it to guide implementation and review work, including input validation, secret handling, error logging, performance logging, comments, tests, and documentation updates.

It provides a minimum checklist for catching common quality and security problems. It also reminds developers to verify changes and keep related documentation current.

must — Cursor rule by mywand

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add rules/mywand/cusrsor-do-it/must

Clone the repo

git clone --depth 1 https://github.com/mywand/cusrsor-do-it

Made for: Cursor.

Per session 1,710 This file is loaded in full into every session.

When invoked 1,710 The same file — it is already loaded in full.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.01710	$0.01710
Opus 5	$0.00855	$0.00855
Sonnet 5	$0.00342	$0.00342
Haiku 4.5	$0.00171	$0.00171

Measured 2d ago against content hash 8dc34e22e286, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

must scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/rules/tools/must.mdc · 183 lines

How it starts

The opening of the file, as written. The whole thing — 183 lines — stays where its author put it; the contents beside it link to each section on GitHub.

最近更新: 2025-11-30

基本合规规则

这是所有项目必须遵循的最小合规规则集，确保基本质量底线。

0. 核心职责

必须使用中文简体回答用户问题
你的核心职责是生成高质量代码、优化性能、并主动协助排查与解决技术问题
每个功能修改完成后，都要检查一下修改是否正确，并更新相关文档

1. 输出规范

1.1 语言要求

技术术语可保持英文，但解释必须用英文
代码注释使用英文，变量名可用英文，源码中不要用特殊字符
若需绘图统一使用 Mermaid

1.2 代码输出要求

生成的代码必须能够直接运行
包含必要的导入语句和依赖
提供清晰的使用示例
代码内仅在必要处加注释，注释风格遵循目标语言的标准文档注释（Javadoc / XML Doc / Docstring 等）

1.3 执行环境要求

命令行工具：操作台命令默认使用 PowerShell，无法使用 PowerShell 则使用 CMD
中文处理：涉及中文字符处理时，默认使用 Python 脚本（UTF-8 编码），避免 PowerShell/CMD 编码乱码问题
生成的脚本应考虑跨平台兼容性（Windows/Linux/macOS）
涉及系统命令时需说明运行环境要求

2. 质量保障

2.1 日志规范

2.1.1 必要日志

错误日志: 所有异常必须记录
关键操作日志: 重要业务操作必须记录
性能日志: 关键路径的耗时记录

2.1.2 日志格式

[时间] [级别] [模块] 消息内容

2.2 注释规范

2.2.1 必要注释

复杂业务逻辑必须有注释说明
公共接口必须有文档注释
重要配置项必须有说明

2.2.2 注释质量

说明"为什么"而不是"是什么"
保持注释与代码同步
避免无意义的注释

2.3 自检清单

2.3.1 代码提交前检查

代码能够编译通过
核心功能已测试
错误处理已实现
必要日志已添加
关键注释已编写

2.3.2 文档检查

README 文件已更新
API 文档已更新
配置说明已完善

2.3.3 功能修改后检查

修改是否正确实现
相关文档已更新
边界情况已考虑
异常处理已覆盖

3. 安全基线

3.1 输入验证

所有外部输入必须验证
防止 SQL 注入
防止 XSS 攻击

3.2 敏感信息

不在代码中硬编码密码
不在日志中输出敏感信息
使用环境变量管理配置

4. 性能基线

4.1 响应时间

接口响应时间 < 2秒
数据库查询 < 1秒
页面加载时间 < 3秒

4.2 资源使用

避免内存泄漏
合理使用缓存
优化数据库查询

5. 工作流程要求

5.1 输出前自检

需求覆盖完整
命名一致性
边界/异常处理
可读性与可维护性

5.2 假设管理

任何假设需显式列入"待确认"
提交前逐项闭环所有待确认项

5.3 快速合规模板

TL;DR | 需求覆盖 | 方案摘要 | 关键变更 | 已完成 | 待确认 | 风险与后续

6. 问题分析与修复原则

6.1 判断代码有问题前的必要验证

在判断代码有问题之前，必须完成以下验证：

前后端一致性验证 ⚠️ 关键
- 查看前端实际调用代码（不能仅凭后端代码判断）
- 确认参数的实际含义和取值范围
- 验证前后端的约定（如：pageIndex 从 0 还是 1 开始）
业务上下文理解 ⚠️ 关键
- 理解为什么代码这样写（可能有历史原因）
- 检查是否有业务文档或注释说明
- 询问是否有已知的特殊场景
横向对比验证 ⚠️ 关键
- 对比项目中其他类似功能的实现
- 注意：必须确认是否服务于相同的客户端
- 注意：不同接口可能有不同的约定
技术逻辑验证
- 验证数据类型的取值范围
- 验证算法逻辑的正确性
- 检查边界条件的处理是否合理

6.2 不要过度修复

❌ 不要在没有充分验证的情况下修改代码
❌ 不要假设所有接口必须使用相同的规则
❌ 不要因为"看起来不对"就修改代码
✅ 如果代码能正常工作，可能它就是对的
✅ 理解业务上下文比修改代码更重要
✅ 鼓励质疑和反向验证

Read the full file on GitHub · 183 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 183 lines · 1,710 tokens per session scan A 8dc34e22e286

Subscribe to this mod's changes

must is a cursor rule published in the GitHub repository mywand/cusrsor-do-it (2 stars, last pushed 7mo ago), licensed Apache-2.0. It adds 1,710 tokens to every session, about $0.0086 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.