Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/worldliberty/agentpay-sdkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/worldliberty/agentpay-sdk/cursor-agentpay-sdk)<a href="https://agentmods.dev/rules/worldliberty/agentpay-sdk/cursor-agentpay-sdk"><img src="https://agentmods.dev/badge/rules/worldliberty/agentpay-sdk/cursor-agentpay-sdk/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/worldliberty/agentpay-sdk/cursor-agentpay-sdk"><img src="https://agentmods.dev/badge/rules/worldliberty/agentpay-sdk/cursor-agentpay-sdk.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00032 | $0.00610 |
| Opus 5.5 | $0.00013 | $0.00244 |
| Sonnet 5.5 | $0.00006 | $0.00122 |
| Haiku 4.5 | $0.00003 | $0.00061 |
Grade A, and why
cursor-agentpay-sdk scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Load the installed agentpay-sdk skill when the task touches Link fiat setup, cards, wallet operations, or payments.
Specific rules:
- start with
agentpay config show --json - for fiat/card payments, start with
agentpay link status --json; if Link is not authenticated, useagentpay link onboard - list Link payment methods with
agentpay link payment-methods --json - create one-time card credentials with
agentpay link card --payment-method-id <id> --merchant-name <name> --merchant-url <url> --amount <cents> --context <100+ char explanation> --output-file <PATH>and never print full card details into chat - for third-party program integration, use
@worldlibertyfinancial/agentpay-sdk/linkhelpers through the AgentPay Link facade - use
agentpay wallet --jsonto determine whether a reusable wallet exists - if the user only asks what the skill can do, answer from
SKILL.mdand do not probe the machine first - never ask the user to paste
VAULT_PASSWORDinto chat - never ask the user to paste Link card numbers, CVCs, access tokens, refresh tokens, or full credential files into chat
- tell the user to run
agentpay admin setuplocally when wallet metadata is unavailable and they are trying to use the wallet - tell the user to run
agentpay admin setup --reuse-existing-walletlocally when the wallet exists and they need to re-run setup without changing vaults - after a fresh setup, tell the user to create an encrypted offline backup with
agentpay admin wallet-backup export --output <PATH>unless they already have a verified backup - if the local wallet is gone but the user has an encrypted backup, tell them to run
agentpay admin setup --restore-wallet-from <PATH>locally - default unspecified payments to
USD1onbsc - check native gas before outbound actions
- if funding is missing, ask the user to fund the wallet and provide address, network, token needs, BNB gas needs, and QR
- if a request hits manual approval, say it is waiting for user approval and route the user to the local admin CLI approval commands first; for
transfer --broadcast,transfer-native --broadcast, andapprove --broadcast, tell them to keep the original command running and not rerun it after approval; if that original broadcast command is already gone after approval, useagentpay admin resume-manual-approval-request --approval-request-id <UUID> - use
agentpay --helpand subcommand help as the source of truth for exact flags - prefer
agentpay admin tuifor policy changes over vague policy discussion
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 29 lines · 32 tokens per session scan A 92a2b7198923
cursor-agentpay-sdk is a cursor rule published in the GitHub repository worldliberty/agentpay-sdk (463 stars, last pushed 4mo ago), licensed MIT. It adds 32 tokens to every session and 610 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
cursorrules
You have a CardZero payment wallet on Base (Coinbase L2) for making USDC payments.
elizaos_v2_onchain_plugins
┌─────────────────┐ ┌──────────────────┐ ┌─────────────────┐ │ Wallet Provider│ │ Connection Mgmt │ │ Transaction Svc │ │ - Private Keys │───▶│ - RPC Endpoints │───▶│ - Tx Construction│ │ - Public Keys │ │ - Network Config │ │ - Fee Estimation│ │ - Signatures │ │ - Health Check │ │ - Broadcasting │ └─────────────────┘…
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
prefer-assertions-over-defensive-checks
Prefer assertions over defensive checks when data is guaranteed to be valid.