Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/xuliang2024/cutcli-cookbook/commandsgit clone --depth 1 https://github.com/xuliang2024/cutcli-cookbookWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01172 | $0.01172 |
| Opus 5 | $0.00586 | $0.00586 |
| Sonnet 5 | $0.00234 | $0.00234 |
| Haiku 4.5 | $0.00117 | $0.00117 |
Grade C, and why
commands scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -s https://cutcli.com/cli | bash Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s https://cutcli.com/cli | bash How it starts
The opening of the file, as written. The whole thing — 162 lines — stays where its author put it; the contents beside it link to each section on GitHub.
命令速查
npm scripts
# 文档站
npm run docs:dev # 本地预览 http://localhost:5173
npm run docs:build # 输出到 docs/.vitepress/dist/
npm run docs:preview # 预览构建产物
# Lint
npm run lint # 跑全部 lint：cases + commands + links
npm run lint:cases # 只校验所有 examples
npm run lint:cmds # grep 公开仓有没有裸 cut 命令
npm run lint:links # markdown 内部链接可达性
# 案例脚手架
npm run new:example my-case # 在 examples/99-community/<handle>/my-case/ 生成骨架
# 部署 (CI 自动跑；本地手动也可)
npm run r2:upload # 增量上传 dist 到 R2 cutcli-docs
npm run r2:gc -- --yes # 删除 R2 中已不在 dist 的孤儿对象（每周一次）
npm run worker:dev # 本地起 worker dev server
npm run worker:deploy # wrangler deploy 到 docs-cutcli
npm run deploy # = docs:build + r2:upload + worker:deploy
案例校验
# 校验单个 case
node scripts/validate-example.mjs examples/01-hello-caption
# 校验所有
node scripts/validate-example.mjs --all
docs/reference 同步（来自闭源仓）
# 在闭源仓内
cd /Users/m007/codes/jy_cli
# 看会写什么、不实际写
node scripts/sync-to-cookbook.mjs --dry-run
# 实际同步（默认输出到 ../cutcli-cookbook/docs/reference/）
node scripts/sync-to-cookbook.mjs
# 自定义输出位置
node scripts/sync-to-cookbook.mjs --out /tmp/sync-test/
# 跑同步脚本的单元测试
node scripts/sync.test.mjs
git / gh
# 查看状态
git status -s
# 提交（遵循 Conventional Commits，详见 commit-flow.mdc）
git commit -m "feat(examples): add 06-cinematic-title"
# 推送
git push
# 看 CI 跑得怎么样
gh run list --limit 5
gh run watch <id>
gh run view <id> --log-failed | tail -40
# 手动触发 deploy
gh workflow run deploy-docs.yml
# 配 secret
gh secret set CLOUDFLARE_API_TOKEN --body "$CLOUDFLARE_API_TOKEN"
gh secret set CLOUDFLARE_ACCOUNT_ID --body "11c47779f0d4c3d0e69ccc6c484dc589"
# 看 secret 列表
gh secret list
# 开 issue
gh issue create --title "..." --body-file body.md --label good-first-issue
Cloudflare wrangler
本地用本仓的
worker/node_modules/.bin/wrangler，避免 npx 拉取慢。
WR=worker/node_modules/.bin/wrangler
# 检查身份
$WR whoami
# R2 bucket 操作
$WR r2 bucket create cutcli-docs
$WR r2 bucket list
$WR r2 object put cutcli-docs/<key> --file=<local>
$WR r2 object delete cutcli-docs/<key>
# Worker 部署
cd worker && $WR deploy
cd worker && $WR tail # 实时日志
cd worker && $WR dev # 本地
# 看版本
$WR --version
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 162 lines · 1,172 tokens per session scan C 2d05ddd68b2e
commands is a cursor rule published in the GitHub repository xuliang2024/cutcli-cookbook (192 stars, last pushed 3mo ago), licensed MIT. It adds 1,172 tokens to every session, about $0.0059 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
cli-error-handling
CLI command error handling patterns.
prefer-direct-imports-over-module-mocks
Prefer extracting a testable core over vi.mock / vi.resetModules when unit tests need to reach production logic entangled with config, env, or singletons.
control-plane-descriptors
Control plane descriptor and instance implementation patterns.
family-instance-domain-actions
Family instance domain action implementation patterns.