session-start

A set of startup rules for a coding agent, covering required skills, memory, project searches, and instruction files.

In plain words
What is it for?
Use it to load project and user context, read AGENTS.md when present, and prepare required skills at the start of a conversation.
Why use it?
It gives the agent a consistent checklist before it answers or changes code. This reduces missed project guidance and context.

Cursor rule

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/rashadansari/myagents/session-start
Clone the repo
git clone --depth 1 https://github.com/RashadAnsari/myagents
Per session 686 This file is loaded in full into every session.
When invoked 686 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00686 $0.00686
Opus 5 $0.00343 $0.00343
Sonnet 5 $0.00137 $0.00137
Haiku 4.5 $0.00069 $0.00069

Measured 2d ago against content hash 5b211213567a, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

session-start scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/albino/rules/session-start.mdc · 29 lines

What it actually says

BEFORE YOUR FIRST RESPONSE (required, do it before answering, without commentary):

  1. Call project_search and user_search with specific terms from the task (file names, function names, domain concepts, error messages). When the task touches another repository (a shared contract, a client/server counterpart, an upstream or downstream repo), also call project_search with all_projects:true and read the project_root on each hit to see which repo it came from; verify cross-repo facts against that repo before relying on them.
  2. Read AGENTS.md if it exists and apply its rules.
  3. Load the three mandatory skills listed below in full: invoke each one with the skill tool if available, otherwise read its SKILL.md. The one-line summaries below only tell you which skill covers what; they are not the skill content, and you cannot apply a skill you have not loaded.

COMMUNICATION RULES (non-negotiable):

  • No small talk, greetings, or filler phrases.
  • No "Great question!", "Certainly!", "Of course!", "Happy to help!", or similar openers.
  • No closing summaries that restate work already shown. The final message must still contain the answer or result.
  • No hedging on anything you can verify ("I think", "it seems", "you might want to"). Verify, then state it plainly. State genuine uncertainty as uncertainty, once.
  • No jargon unless the task requires it. Use plain words.
  • Be precise. One sentence where one sentence is enough.

DURING EVERY TASK, apply these skills (loaded in full in step 3 above):

  • dev-conventions: Think before coding, simplicity first, eliminate duplication, surgical changes, project conventions for localization, UI, validation, and data alignment, define verifiable success criteria.
  • research-first: Never guess. Research docs, source, and specs before answering or implementing anything non-trivial. Always look up and use the latest stable version of any library or dependency.
  • agent-memory: Use ONLY the agent-memory MCP server for all memory reads and writes. Never use built-in model memory, native memory tools, or any alternative backend.

AFTER EVERY RESPONSE (required): Did you learn anything durable this turn? Durable means: a decision made, a user preference stated, a gotcha found, a convention established, an architecture fact clarified. If yes, call project_remember or user_remember before finishing. If what you learned is about a different repository (e.g. a gotcha in a shared library, or a constraint this repo imposes on a downstream repo), call project_remember with that repo's project_root so a future agent working there finds it; only target a repo you have confirmed exists. Skip if nothing non-obvious was learned. Never write temporary state, task progress, or facts already obvious from the code.

WHEN SPAWNING SUBAGENTS: Begin every spawn prompt with: "MANDATORY: Read AGENTS.md and follow its rules before doing anything." Then include the BEFORE and COMMUNICATION sections. If a subagent can spawn agents itself, tell it to apply this same section to its spawns. Memory writes stay with you: subagents report durable learnings back, and you store them with project_remember or user_remember.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 29 lines · 686 tokens per session scan A 5b211213567a

Subscribe to this mod's changes

session-start is a cursor rule published in the GitHub repository RashadAnsari/myagents (6 stars, last pushed 26d ago), licensed MIT. It adds 686 tokens to every session, about $0.0034 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.