PatrickJS/awesome-cursorrules is a collection of Markdown rule files that give Cursor AI editor project-specific instructions about code, frameworks, workflows, and standards. Developers use it to find reusable guidance for shaping Cursor’s behavior in different kinds of software projects.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/patrickjs/awesome-cursorrules/pr-review-cursorrules-prompt-filegit clone --depth 1 https://github.com/PatrickJS/awesome-cursorrulesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/patrickjs/awesome-cursorrules/pr-review-cursorrules-prompt-file)<a href="https://agentmods.dev/rules/patrickjs/awesome-cursorrules/pr-review-cursorrules-prompt-file"><img src="https://agentmods.dev/badge/rules/patrickjs/awesome-cursorrules/pr-review-cursorrules-prompt-file.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01031 | $0.01031 |
| Opus 5 | $0.00515 | $0.00515 |
| Sonnet 5 | $0.00206 | $0.00206 |
| Haiku 4.5 | $0.00103 | $0.00103 |
Grade A, and why
pr-review-cursorrules-prompt-file scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 82 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PR Review — focused review prompts for Cursor
When the user asks you to review a pull request, set of changes, or "this PR", run the appropriate review angle from the four below. Pick based on the user's emphasis ("security", "perf", "tests", "arch"). If unspecified, ask which angle, or default to security.
Output discipline (applies to all angles):
- Cite file path and line number for each finding.
- Rank findings by severity: blocker, important, nit.
- Be specific. "This looks risky" is not a finding; "src/auth.ts:42 — JWT secret read from request body, see line 41" is.
- If the diff doesn't give you enough context to be sure, say so explicitly and ask for the surrounding file.
- End with a verdict on its own line:
Safe to merge | needs changes | reject.
Angle 1: SECURITY
You are reviewing the PR for security defects. Focus, in order of priority:
- Auth/authz — new endpoints or branches missing auth checks, role assumptions, IDOR
- Input validation — untrusted input flowing into queries, shell, file paths, deserialization, eval
- Injection — SQL, NoSQL, command, prompt injection, template injection
- Secrets — hardcoded keys/tokens, secrets in logs, secrets in client-bundled code, .env committed
- Output encoding — XSS via unescaped templating, HTML in user content, JSONP-style leaks
- Crypto/randomness — Math.random for tokens, MD5/SHA1, missing IVs, custom-rolled crypto
- Data exposure — PII in logs, overshared API responses, missing redaction
Skip nice-to-haves. Stick to defects.
Angle 2: PERFORMANCE
You are reviewing for performance regressions. Focus:
- N+1 patterns — loops doing DB/network calls per item without batching
- Hot-path allocations — new objects/arrays/maps inside loops, regexes recompiled per call
- Unbounded work — pagination missing, results sets unconstrained, recursion without depth cap
- Bad async — sequential awaits where Promise.all is correct, missing concurrency limits
- Cache misuse — cache keys that don't include the right variables, cache TTLs absent or pathological
- Algorithm complexity — O(n^2) hidden in
.someover.map, sort inside loops
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 82 lines · 1,031 tokens per session scan A 4f971df6469b
pr-review-cursorrules-prompt-file is a cursor rule published in the GitHub repository PatrickJS/awesome-cursorrules (40,732 stars, last pushed 3mo ago), licensed CC0-1.0. It adds 1,031 tokens to every session, about $0.0052 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other cursor rules, from other repositories
karen-repo-reviewer
Use Karen for brutally honest repository reviews with market-aware Karen Scores. Analyzes entire codebases for over-engineering, completion honesty, and whether the project actually solves a real problem.
refactoring
Refactoring: systematic approach, extract/inline, guard clauses, early returns.
clean-code
Clean code: naming, functions, simplicity.
code-review
Code review: reviewing approach, authoring PRs, feedback conventions.
git-workflow
Git workflow: commits, branches, PRs, history management.
snyk_rules
Snyk Security At Inception.