A project rule for running safelint, a static-analysis tool that checks source code for safety and complexity problems using Holzmann’s Power of Ten guidelines.

Use it for safelint checks, safety reviews, and Power-of-Ten reviews across supported programming languages.

It highlights risky code patterns such as excessive nesting, long functions, weak error handling, hidden side effects, and possible unsafe data flow.

safelint — Cursor rule for Cursor by shelkesays

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/shelkesays/safelint

Made for: Cursor.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/rules/shelkesays/safelint/safelint/github.svg)](https://agentmods.dev/rules/shelkesays/safelint/safelint)

Your own site

<a href="https://agentmods.dev/rules/shelkesays/safelint/safelint"><img src="https://agentmods.dev/badge/rules/shelkesays/safelint/safelint/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/rules/shelkesays/safelint/safelint"><img src="https://agentmods.dev/badge/rules/shelkesays/safelint/safelint.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 85 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 6,428 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 2 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00085	$0.06428
Opus 5	$0.00043	$0.03214
Sonnet 5	$0.00017	$0.01286
Haiku 4.5	$0.00009	$0.00643

Measured 12d ago against content hash a7d0a52ed59b, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade B, and why

safelint scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Strips warnings and disclaimersmediumAnti-refusal

Omitting safety caveats hides risk from the user and is a common jailbreak preamble.

Briefly explain the Power-of-Ten rationale (one or two sentences). Reference the rule code and the underlying safety property. Don't lecture; keep it tight.

Runs shell commandslowCapability

Expected in a hook, worth knowing in a rule or an instructions file.

| SAFE802 | return_value_ignored | Discarding the return value of error-signalling functions like `subprocess.run` silently swallows failures. |

src/safelint/skill_files/cursor/safelint.mdc · 226 lines

How it starts

The opening of the file, as written. The whole thing — 226 lines — stays where its author put it; the contents beside it link to each section on GitHub.

safelint: Cursor project rule

You are running the safelint static-analysis CLI on behalf of the user. safelint enforces Holzmann's "Power of Ten" safety rules adapted from C/C++ aerospace conventions to modern languages: function length, nesting depth, cyclomatic complexity, error-handling discipline, hidden side effects, dataflow taint, and similar. The same rule set applies across every language safelint supports; only the parser and language-specific node types differ.

This rule mirrors the Anthropic Claude Code skill that ships in the same package. Both clients read the same workflow so behaviour stays consistent. Cursor reads this file from .cursor/rules/safelint.mdc (project) or ~/.cursor/rules/safelint.mdc (user-global); language-specific addendums live in the bundled package and can be located via safelint skill path (the addendums sit at <that path>/languages/<lang>.md). The JSON output schema lives in the safelint repo at docs/json-schema.md. It is not shipped inside the wheel.

Follow the steps below in order.

Step 1: Verify safelint is installed

Run safelint --version in a terminal task. This is portable across macOS, Linux, and Windows shells (cmd / PowerShell / git-bash) and returns non-zero whenever safelint isn't on PATH. If you specifically need a "is the binary findable?" check without invoking it, fall back to python -c "import shutil, sys; sys.exit(0 if shutil.which('safelint') else 1)".

If either check returns non-zero (or the shell reports "command not found" / "is not recognized"):

safelint is a Python package regardless of the language being linted, but v2.0.0+ ships language grammars as opt-in extras, so the install command needs a [<lang>] suffix matching the project's language(s). Glance at file extensions in the project tree, then suggest:

Project contains	Install command
`.py` / `.pyw`	`uv add 'safelint[python]'` or `pip install 'safelint[python]'` (Django / Flask / FastAPI via `[tool.safelint.python] framework = "..."`, plus the optional `pydantic = true` toggle, see `languages/python.md`)
`.js` / `.mjs` / `.cjs`	`uv add 'safelint[javascript]'` or `pip install 'safelint[javascript]'`
`.ts` / `.tsx` / `.as`	`uv add 'safelint[typescript]'` or `pip install 'safelint[typescript]'` (bundles JS)
`.java`	`uv add 'safelint[java]'` or `pip install 'safelint[java]'` (Spring Boot via `[tool.safelint.java] framework = "spring-boot"`, see `languages/java.md`)
`.rs`	`uv add 'safelint[rust]'` or `pip install 'safelint[rust]'` (Rust-specific rules and Holzmann-inspired additions; see `languages/rust.md`)
`.go`	`uv add 'safelint[go]'` or `pip install 'safelint[go]'` (Go-specific rules and idiomatic adaptations; see `languages/go.md`)
`.php`	`uv add 'safelint[php]'` or `pip install 'safelint[php]'` (Laravel via `[tool.safelint.php] framework = "laravel"`; PHP-specific rules and idiomatic adaptations; see `languages/php.md`)
`.c`, `.h`	`uv add 'safelint[c]'` or `pip install 'safelint[c]'` (C-specific rules and the Power-of-Ten "homecoming"; see `languages/c.md`)
`.cpp`, `.cxx`, `.cc`, `.hpp`, `.hxx`, `.hh`	`uv add 'safelint[cpp]'` or `pip install 'safelint[cpp]'` (C++ idiom rules layered on the C family; see `languages/cpp.md`)
Multiple languages	Compose, e.g. `pip install 'safelint[python,javascript]'`
Unsure / kitchen-sink	`pip install 'safelint[all]'`

Read the full file on GitHub · 226 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

12d ago First seen · 226 lines · 85 tokens per session scan B a7d0a52ed59b

Subscribe to this mod's changes

safelint is a cursor rule published in the GitHub repository shelkesays/safelint (7 stars, last pushed 8d ago), licensed MIT. It adds 85 tokens to every session and 6,428 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 2 findings (strips warnings and disclaimers, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Debugging

error-handling-and-validation

A code-quality guide for handling errors, invalid inputs, edge cases, preconditions, logging, and user-friendly error messages.

holtwood/awesome-cursorrules-zh · 185 tokens

css-render-blocking-diagnosis

Cursor rule "css-render-blocking-diagnosis" from adobecom/da-express-milo, covering css render-blocking diagnosis & resolution, critical learning from 98 pagespeed achievement, primary diagnostic protocol, step 1: css blocking symptom recognition and step 2: css loading sequence audit.

adobecom/da-express-milo · 1,102 tokens

safelint