Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/YuDefine/nuxt-supabase-starterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/manual-review)<a href="https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/manual-review"><img src="https://agentmods.dev/badge/rules/yudefine/nuxt-supabase-starter/manual-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/manual-review"><img src="https://agentmods.dev/badge/rules/yudefine/nuxt-supabase-starter/manual-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.11764 |
| Opus 5 | $0.00000 | $0.05882 |
| Sonnet 5 | $0.00000 | $0.02353 |
| Haiku 4.5 | $0.00000 | $0.01176 |
Grade A, and why
manual-review scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- session owner 已實際跑驗證（grep / read / curl）確認事實成立 How it starts
The opening of the file, as written. The whole thing — 456 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Runtime adapter boundary
The obligations, predicates, evidence schema, failure handling, and review timing in this source are shared. Concrete browser, dispatch, question, filesystem, and command mechanics are target-native and MUST come from the selected runtime fragment at the matching adapter path. A fragment declares only the capability it can prove; an absent or unverified capability remains blocked and MUST NOT be silently replaced by a neighbouring runtime.
人工檢查（Manual Review）
本檔是 path-scoped 主檔（2026-07-05 起 path-scoped，2026-09-07 改綁
tasks/**/specs/plans/**/screenshots/**——manual-review 內容只在有進行中的 work item 時才用得到；原 always-load 佔 30KB 為預算最大單檔），列核心 invariant、Item Kind Marker 一覽、claude-analyzed annotation、@evidence-via-marker、Parent State Derivation、Post-Edit Gate、禁止事項。 詳細規約依場景 path-scoped 載入：
Sub-file Path-scoped 觸發 內容 [[manual-review.backend]] server/**、test/**、e2e/**、supabase/**Backend-only change 規約 + 標準流程 verify channels + review:ui flow [[manual-review.data-readiness]] tasks/**、specs/plans/**Pre-Review Data Readiness + step actionability + @no-manual-review-checkmarker + 截圖檔名配對[[manual-review.evidence]] tasks/**、specs/plans/**、docs/manual-review-archive.md給規格寫作者 + Kind 分類指引 + 反例 + @no-screenshotmarker + annotation / marker 細節（claude-analyzed、awaiting-user-decision、@evidence-via-manual-review、@apply-blocked、ADR、真相層責任分工）
這套機制在解什麼問題（先讀，決定你該不該用它）
截圖證據是防偽——證明 agent 真的做了、成品真的長那樣。它擋的是 [x] 但沒做的 false-green，不是「這個設計好不好」。
兩件事對證據的要求剛好相反，混用會兩邊都做不好：
| 防偽（本檔管的） | 美學判斷（不是本檔管的） | |
|---|---|---|
| 要什麼 | 每項都有、不可偽造、可追溯 | 可互動、看得到動態、能並排比較 |
| 時機 | 實作後留存 | 實作前 |
| 成本容忍 | 高（防作弊值得付） | 低（每輪都要付） |
| 靜態截圖 | ✅ 剛好適合 | ❌ 完全不適合 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +84 lines e3e5b5ebaedf
- 5d ago First seen · 372 lines · 0 tokens per session scan A 9d96e8a82b0e
manual-review is a cursor rule published in the GitHub repository YuDefine/nuxt-supabase-starter (45 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 11,764 tokens. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other cursor rules, from other repositories
testing
Vitest, React Testing Library, and Playwright testing standards. Enforces TDD/BDD, test pyramid, zero brittle mocks, and complete assertion coverage.
entire-external-agent
Build standalone external agent binaries for the Entire CLI using E2E-first TDD.
functional-test-principals.rules
Purpose: Ensure all test suites — regardless of test framework — validate real, end-to-end or integration-level functionality. Tests must act as a backstop for the app. If they pass, the app works. If they fail, something meaningful is broken. This allows the agent to self-validate and iterate safely.
playwright-agents
Playwright test agent workflows for planning, generating, and healing tests.
vasu-playwright-utils
Use vasu-playwright-utils for Playwright tests. Follow locator strategy (data-testid, role, label). Use with playwright-cli to verify flows.
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.