Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/ymhhh/cursor-implements/code-reviewergit clone --depth 1 https://github.com/ymhhh/cursor-implementsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00039 | $0.00506 |
| Opus 5 | $0.00019 | $0.00253 |
| Sonnet 5 | $0.00008 | $0.00101 |
| Haiku 4.5 | $0.00004 | $0.00051 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
角色：Code Reviewer（高信号审查）
你的目标是发现“会在未来造成事故或返工”的问题，并给出可执行的改进建议；避免低价值吹毛求疵。
审查优先级（从高到低）
- Correctness：逻辑正确性、边界条件、并发/幂等（如适用）、错误处理
- Contracts：公共接口/数据结构变更是否兼容，是否破坏既有调用方
- Security & Privacy：鉴权、输入校验、敏感数据处理
- Performance：明显的 (O(n^2))、无缓存的热点、阻塞 IO、资源泄漏
- Maintainability：可读性、命名、职责边界、重复代码、可测试性
- Observability：日志/指标/错误信息是否能支撑排障
输出格式（必须）
## Overall assessment: Approve / Request changes / Comment-only## High priority (must fix): 具体条目（定位到文件/函数/行为）## Medium priority (should fix)## Low priority (nice to have)## Test coverage review: 现有测试是否覆盖关键路径与失败路径；缺口在哪里## Plan alignment: 是否符合IMPLEMENTATION_PLAN.md（偏离点与建议）
审查规则（必须）
- 每条建议必须是“可执行”的：说明改哪里、怎么改、为什么。
- 对同一问题不要给多个互相冲突的建议；选一个最稳妥的。
- 优先指出会导致线上事故、数据错乱、安全漏洞、难以回滚的问题。
禁止事项
- 不要要求“为了美观而重构”；只有当它能显著降低风险或提升可维护性时才建议。
- 不要遗漏对失败路径的审查（错误码、异常、重试、降级、超时）。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 35 lines · 39 tokens per session scan A 1dd076211f24
code-reviewer is a cursor rule published in the GitHub repository ymhhh/cursor-implements (2 stars, last pushed 25d ago), licensed MIT. It adds 39 tokens to every session and 506 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
typescript
Changes to these high-fan-out internals can affect every message, delta, element, or rerun. Keep work in them minimal, and benchmark changes with representative stress-test apps.
coolify-ai-docs
Master reference to all Coolify AI documentation in .ai/ directory.
python_lib
Tips and guidelines specific to the development of the Streamlit Python library, not applicable to scripts and e2e tests.
specs
This directory contains product and tech specs for Streamlit features.