Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/YuDefine/nuxt-supabase-starternpx agentmods add rules/yudefine/nuxt-supabase-starter/consumer-metaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/consumer-meta)<a href="https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/consumer-meta"><img src="https://agentmods.dev/badge/rules/yudefine/nuxt-supabase-starter/consumer-meta/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/consumer-meta"><img src="https://agentmods.dev/badge/rules/yudefine/nuxt-supabase-starter/consumer-meta.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.04623 |
| Opus 5 | $0.00000 | $0.02312 |
| Sonnet 5 | $0.00000 | $0.00925 |
| Haiku 4.5 | $0.00000 | $0.00462 |
Grade A, and why
consumer-meta scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 278 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Consumer Meta（per-consumer 自宣告 + clade 聚合 snapshot）
核心命題：clade 的規則 / skill / audit / cookbook 需要知道每個 consumer 的「runtime 事實」（dev port、auth provider、DB instance、deploy platform、是否 OAuth port-pinned），但這些事實 source-of-truth 在各 consumer repo（package.json / nuxt.config.ts / wrangler.toml / .env.example）。
過去這些知識散在：
- memory entries（「 是 trunk-based」「 OAuth port pin」）
- 規則內 hardcoded（
proactive-skills.md § Dev Server Auto-Spawn寫死 3001-3050） - audit script 內 grep 推測
- 各 consumer 自家 local rule 自己重述
收口辦法：
- 每個 consumer 在自家 repo 加
.claude/consumer-meta.json，git tracked，依registry/consumer-meta.schema.jsonschema - clade aggregator（
scripts/sync-consumer-meta.ts）從各 consumer 拉 meta，cross-validate 對應package.json/wrangler.toml/nuxt.config.ts，generated fields 帶source: <file>provenance - clade 聚合 snapshot 寫到
registry/consumers-meta.json，給規則 / skill / audit 讀
設計原則
| 原則 | 內容 |
|---|---|
| Declarative > Derivable | manifest 只放不能穩定推導的事實（auth provider、leaseMode、OAuth pin 與否）。框架版本、依賴清單、wrangler project name 等可推導欄位由 aggregator 從 source file 讀取並驗證，不寫進 manifest |
| Cross-validation | aggregator 對每個欄位驗一致性：consumer-meta 宣告 dev.ports[0].port=3000 → aggregator 讀 package.json scripts.dev 確認真有 --port 3000；不一致 → 寫 validation.errors 進 snapshot |
| Source provenance | snapshot 內每個 derived 欄位附 source: <relative-path>:<line-or-key>，讓後續讀者知道事實從哪來 |
| No secrets | manifest NEVER 含 password / token / API key。只記 env var 名稱，值由各 consumer 自家 .env.local 解析 |
檔案位置
~/offline/clade/
registry/
consumer-meta.schema.json # JSON Schema for per-consumer meta
consumers.json # governance registry (existing)
consumers.schema.json # governance schema (existing)
consumers-meta.json # aggregated snapshot (generated by sync-consumer-meta.ts)
rules/core/
consumer-meta.md # 本檔
scripts/
sync-consumer-meta.ts # aggregator
vendor/snippets/
consumer-meta/
README.md
<consumer-b>.consumer-meta.json # 範例（fully filled）
<consumer-a>.consumer-meta.json # 範例（fully filled）
~/offline/<each-consumer>/
.claude/
consumer-meta.json # 每 consumer 自宣告，git tracked
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +1 lines 44dd7536f801
- 6d ago First seen · 277 lines · 0 tokens per session scan A d1847eef3859
consumer-meta is a cursor rule published in the GitHub repository YuDefine/nuxt-supabase-starter (45 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 4,623 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other cursor rules, from other repositories
viberaven-deploy
Apply before changing Vercel config or deploy CI workflows.
cloudflare-infrastructure
Cloudflare infrastructure patterns and best practices.
speckit_speckit.checklist
Proxy for the speckit.checklist workflow.
speckit_speckit.taskstoissues
Proxy for the speckit.taskstoissues workflow.
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.