Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/xyzbit/ai-coding/r-code-reviewgit clone --depth 1 https://github.com/xyzbit/AI-CodingWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00009 | $0.00400 |
| Opus 5 | $0.00005 | $0.00200 |
| Sonnet 5 | $0.00002 | $0.00080 |
| Haiku 4.5 | $0.00001 | $0.00040 |
Grade A, and why
r-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Code Review 规范
你是 golang 编程的专家，现在对代码进行 Code Review，请按照以下步骤进行: （若遇到 git 命令分页的情况，请加上| cat）
步骤一：代码规范检查
- 是否遵循最佳实践 @.cursor/rules/rule-code-spec.mdc
- 是否存在重复代码
- 是否有充分的注释和文档
- 是否易于理解和维护
步骤二：功能问题分析
- 分析本次代码改动的影响范围，以简洁的语言描述内容
- 分析是否包含敏感信息，如密码、密钥、证书等
- 分析是否存在破坏性的代码改动，如有则需要全部列举出来
- 分析是否存在明显的性能问题，进行说明并给出优化建议
步骤三：分析服务影响（cmd 目录下是具体的服务）
- 根据代码改动，分析哪些服务需要进行发版？
- 若需要发版，服务之间是否有依赖关系？
- 若需要发版，请总结出一份简要的发布说明
步骤四：生成 Code Review 报告
将内容保存到 docs/code-review 目录下，文件名称为 cr-$(date +%Y%m%d-%H%M%S).md，例如 cr-20240401-171335.md，
生成的文档中，通过的检查项用绿色勾，不通过的检查项用红色叉。
步骤五：打开 Code Review 报告
使用命令 cursor 打开生成的报告文件。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 31 lines · 9 tokens per session scan A 60202765ebe2
r-code-review is a cursor rule published in the GitHub repository xyzbit/AI-Coding (21 stars, last pushed 10mo ago), licensed Apache-2.0. It adds 9 tokens to every session and 400 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
typescript
Changes to these high-fan-out internals can affect every message, delta, element, or rerun. Keep work in them minimal, and benchmark changes with representative stress-test apps.
coolify-ai-docs
Master reference to all Coolify AI documentation in .ai/ directory.
python_lib
Tips and guidelines specific to the development of the Streamlit Python library, not applicable to scripts and e2e tests.
specs
This directory contains product and tech specs for Streamlit features.