Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/YuDefine/nuxt-supabase-starternpx agentmods add rules/yudefine/nuxt-supabase-starter/manual-review.evidenceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/manual-review.evidence)<a href="https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/manual-review.evidence"><img src="https://agentmods.dev/badge/rules/yudefine/nuxt-supabase-starter/manual-review.evidence/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/manual-review.evidence"><img src="https://agentmods.dev/badge/rules/yudefine/nuxt-supabase-starter/manual-review.evidence.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.09789 |
| Opus 5 | $0.00000 | $0.04895 |
| Sonnet 5 | $0.00000 | $0.01958 |
| Haiku 4.5 | $0.00000 | $0.00979 |
Grade A, and why
manual-review.evidence scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- SSH、`docker exec`、`psql`、`\d <table>`、`SELECT ... FROM`、`curl` 觸發 endpoint 或 cron、受控 drift 製造、migration 存在性驗證、合理性檢查 How it starts
The opening of the file, as written. The whole thing — 490 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Manual Review — Evidence & Authoring Schema
Reference 檔。核心規約見
manual-review.md。本檔聚焦tasks.md的## 人工檢查區塊在 propose / ingest / apply / archive 階段的詳細 authoring schema：可解析格式、kind 分類指引、@no-screenshot/@no-manual-review-checkmarker schema，以及 ### 給 propose / spec 寫作者 的格式建議。
給 propose / spec 寫作者
寫 ## 人工檢查 項目時，MUST 用「動詞 → 結果」格式描述真實使用者操作：
✅ 好：
- [ ] #N Admin 在 `/asset-loans` 點品項 → 開 slideover → 點某筆 active loan 旁「手動歸還」→ dialog 開啟 → 選「正常」+ 不填備註 → 送出 → 200 OK，loan 狀態變 returned，列表自動刷新
❌ 不夠：
- [ ] #N 確認手動歸還按鈕能用
「能用」是模糊驗收，落到實作會被解讀為「能點到 / 看到 dialog」，漏掉真實送出 + DB 變更。
可解析格式（hard rule）
tasks.md 的 ## 人工檢查 區塊必須使用可被工具穩定解析的 #N schema。
Parent item 格式：
- [ ] #1 確認主要流程可完成
- [x] #2 確認錯誤狀態可理解（skip）
Scoped sub-item 格式必須剛好縮排兩個空白，並使用 #N.M：
- [ ] #3 確認行動版流程
- [ ] #3.1 390px viewport 無水平溢出
- [x] #3.2 keyboard focus state 清楚
禁止在 ## 人工檢查 checkbox line 使用 legacy section ids，例如 8.1、9.3，也禁止省略 #N / #N.M。這個 schema 只讓 tooling 能定位與寫回項目，不改變人工檢查 ownership：agent 仍然 NEVER 在未取得使用者明確 OK、Issue handling、skip 或 skip all 前自行勾選 [review:ui] items；[discuss] items 的勾選規則見 manual-review.md 「Item Kind Marker」核心定義。
Kind 分類指引（給 propose / spec 寫作者）
寫 ## 人工檢查 時依以下指引判斷 marker：
[discuss]（後端 evidence collection）
- SSH、
docker exec、psql、\d <table>、SELECT ... FROM、curl觸發 endpoint 或 cron、受控 drift 製造、migration 存在性驗證、合理性檢查 - production 授權 / 商業判斷 / production 觀察項目
[verify:e2e]（Playwright spec 完整 journey）
- mutation persistence across reload
- 多角色 authz + state changes 的完整 journey
- 需要 page navigation + state assertion 的流程
- 需要 CI / local spec 可重跑的 regression evidence
[verify:api]（HTTP round-trip）
- 純 backend contract / endpoint authz
- admin 200 / manager 403 / staff 403 這類 per-role status matrix
- 只需要 METHOD / URL / STATUS / optional body hash 即可驗證的 mutation
- 可由 curl / ofetch 重現的 evidence collection
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · -5 lines a2ca12806ed2
- 4d ago Changed · +2 lines 6b3fe5fcfe27
- 8d ago First seen · 493 lines · 0 tokens per session scan A 47af8c3e399b
manual-review.evidence is a cursor rule published in the GitHub repository YuDefine/nuxt-supabase-starter (45 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 9,789 tokens. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other cursor rules, from other repositories
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
cli-error-handling
CLI command error handling patterns.
prefer-direct-imports-over-module-mocks
Prefer extracting a testable core over vi.mock / vi.resetModules when unit tests need to reach production logic entangled with config, env, or singletons.
control-plane-descriptors
Control plane descriptor and instance implementation patterns.