Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/sordi-ai/skill-everything/review-deploymentgit clone --depth 1 https://github.com/sordi-ai/skill-everythingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/sordi-ai/skill-everything/review-deployment)<a href="https://agentmods.dev/rules/sordi-ai/skill-everything/review-deployment"><img src="https://agentmods.dev/badge/rules/sordi-ai/skill-everything/review-deployment.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00025 | $0.00612 |
| Opus 5 | $0.00013 | $0.00306 |
| Sonnet 5 | $0.00005 | $0.00122 |
| Haiku 4.5 | $0.00003 | $0.00061 |
Grade A, and why
review-deployment scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 76 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Sub-Skill: Review & Deployment Process
Purpose: Prevents deployment accidents and ensures reviews are more than rubber-stamping. Concrete checklists the agent runs through before every PR and deployment.
PR Review Checklist (Agent runs this before opening a PR)
Correctness
- All new functions have tests
- Existing tests pass (
npm test/pytest/ etc.) - Edge cases covered: null/undefined, empty arrays, negative numbers
- No TODO comments without a linked ticket
Security
- No secrets or API keys in code (not even in comments)
- User input is validated before flowing into DB queries or shell commands
- New endpoints have authentication/authorization
- No
eval(),exec(), or dynamic SQL strings without prepared statements
Performance
- No N+1 queries (database queries in loops)
- Large datasets are paginated, not loaded entirely
- New indexes for new WHERE clauses in queries
Maintainability
- Complex logic is commented (the why, not the what)
- No duplicated code blocks (DRY)
- Dependencies updated in
package.json/requirements.txt
Deployment Checklist
Before Deployment
- Check migrations: Are all DB migrations backward-compatible? (No DROP COLUMN without prior deprecation cycle)
- Feature flags: New features behind a feature flag? Especially for large changes.
- Rollback plan: How to roll back if something goes wrong? Documented?
- Monitoring: Are alerts set up for new critical paths?
Deployment Order (for microservices)
- First: Database migrations (additive changes)
- Then: Backend services (new version)
- Last: Frontend (new version)
- Never: Frontend before backend when there are API changes
After Deployment
- Health check endpoint responds with 200
- Error rate in monitoring not elevated (observe for 5 minutes)
- Critical user flows manually tested (login, main feature, checkout)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 76 lines · 25 tokens per session scan A 28e0d1379c2a
review-deployment is a cursor rule published in the GitHub repository sordi-ai/skill-everything (20 stars, last pushed 3mo ago), licensed MIT. It adds 25 tokens to every session and 612 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
skill-creator
Create, edit, evaluate, and debug the skills in this repo, including running their evals and fixing a description that fails to trigger. Use when user says 'help me build a new skill', 'add a skill for X', 'run the evals for the tf skill', 'run the behavioral evals', 'my skill is not triggering', 'fix this skill's…
tf-plan
Review a Terraform plan before applying it: destroys and replacements of data-bearing resources, secrets readable in plan output, out-of-band drift, blast radius, and whether the apply is bound to the plan you actually reviewed. Use when user says 'review my plan', 'is this plan safe to apply', 'check tfplan', 'what…
arcjet-ai-apps
Security guidance for AI/LLM endpoints — layered Arcjet protection with prompt injection, PII blocking, and token budgets.
arcjet-express
Arcjet patterns for Express, Node.js, Fastify, Hono, NestJS, Bun, and Deno — correct adapters, no middleware, proxy config.
ci-triage-demo
Agent rules for ci-triage-demo.
browser-ops-demo
Agent rules for browser-ops-demo.