Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/sordi-ai/skill-everything/typescriptgit clone --depth 1 https://github.com/sordi-ai/skill-everythingWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00021 | $0.02142 |
| Opus 5 | $0.00010 | $0.01071 |
| Sonnet 5 | $0.00004 | $0.00428 |
| Haiku 4.5 | $0.00002 | $0.00214 |
Grade A, and why
typescript scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 222 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Sub-Skill: TypeScript Best Practices
Purpose: Prevents the TypeScript-specific mistakes LLMs make repeatedly — weak types, unsafe assertions, and patterns that compile but fail at runtime.
Rule classification
- MUST — load-bearing. Violating leaks runtime errors past the type checker. Never break.
- SHOULD — default behavior. Deviation needs a documented reason in the code or PR.
- AVOID — usually wrong; documented exception inline where needed.
Where these rules don't strictly apply: test fixtures, generated types (e.g. from GraphQL codegen, OpenAPI generators, Prisma), declaration files (*.d.ts) for untyped third-party libraries, and migration scripts may legitimately differ. The rules below apply to production application code.
Type Safety
-
MUST: Never use
any. Useunknownand narrow it.anydisables the type checker entirely.unknownforces you to prove the type before use. Exception: third-party libraries without types and explicit dynamic-data boundaries (e.g. JSON parse at the API edge), with a comment explaining why.// Wrong function parse(data: any) { return data.name; } // Correct function parse(data: unknown): string { if (typeof data === 'object' && data !== null && 'name' in data) { return String((data as { name: unknown }).name); } throw new Error('Invalid data shape'); } -
AVOID:
Objector{}as a type. Both accept nearly everything. UseRecord<string, unknown>for arbitrary objects or define an explicit interface.// Wrong function merge(a: {}, b: Object): {} { ... } // Correct function merge<T extends Record<string, unknown>>(a: T, b: Partial<T>): T { ... } -
SHOULD: Use
asonly when you know more than the compiler — and document why. Prefer type guards orsatisfiesinstead.// Wrong — silences the error, hides the bug const user = response.data as User; // Correct — validate first function isUser(v: unknown): v is User { return typeof v === 'object' && v !== null && 'id' in v && 'email' in v; } const user = isUser(response.data) ? response.data : null;
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 222 lines · 21 tokens per session scan A b19f7de7d450
typescript is a cursor rule published in the GitHub repository sordi-ai/skill-everything (19 stars, last pushed 3mo ago), licensed MIT. It adds 21 tokens to every session and 2,142 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
00-stack
Stack, runtimes, and MCP servers for this repository.
20-testing
How to run tests and MCP smoke checks.
30-security
Secrets, gitleaks, age encryption, telemetry redaction.
obsidian-memory
Markdown vault memory protocol (vkm-kit).
10-style
Style conventions and contribution hygiene.
retention-predictor
Skill — retention-predictor. Predicts retention potential via usage frequency, habit formation mechanics, and churn risk factors.