Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/yudefine/nuxt-supabase-starter/skill-managementgit clone --depth 1 https://github.com/YuDefine/nuxt-supabase-starterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/skill-management)<a href="https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/skill-management"><img src="https://agentmods.dev/badge/rules/yudefine/nuxt-supabase-starter/skill-management.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01189 |
| Opus 5 | $0.00000 | $0.00594 |
| Sonnet 5 | $0.00000 | $0.00238 |
| Haiku 4.5 | $0.00000 | $0.00119 |
Grade A, and why
skill-management scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 57 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill 管理
三層各自的版控形態
| 層 | 角色 | 版控 |
|---|---|---|
.cursor/skills/** |
canonical 真相層 | MUST 進版控（含第三方 skill） |
.agents/ .codex/ |
sync-to-codex.ts 從 .claude/ 產生的投影 |
MUST gitignore |
skills-lock.json |
各 skill 的 source 與 computedHash | MUST 進版控 |
AGENTS.md 開頭的「AUTO-GENERATED from .claude/」不是註解，是這張表的宣告：投影層可由腳本完整重生，重生得出來的東西不進版控。
為什麼第三方 skill 也要進版控
第三方 skill 用 npx skills add 裝得回來，看起來像「可重生 → 不必進版控」。但它與投影層有一個決定性差異：投影層的來源在本 repo 內，第三方 skill 的來源在別人的 GitHub repo。
npx skills add 拉的是 default branch HEAD，上游一次 force-push 或 refactor，你就再也裝不回當初那一版；repo 被刪或改名則是直接消失。而 skill 內容會實質影響 agent 行為——它不是可有可無的開發工具，是這個 repo 的行為契約的一部分。
進版控的代價是升版時幾萬行 diff，那是可接受的：diff 大但可讀（都是 markdown），且一年也不會升幾次。
三條 MUST
- 安裝一律
--agent claude-code --copy。npx skills add不加--copy的行為不穩定（實測 v4 仍會裝成真實目錄而非 symlink），且 symlink 形態有下面第 3 條的失效模式。 - commit 必須帶上
skills-lock.json。npx skills add會重算 lock 內所有 entry 的computedHash，不只你剛裝的那一支。漏帶會讓 lock 與實際安裝不一致，下次npx skills check報 drift。 - NEVER 讓
.cursor/skills/<name>是 symlink 指向未 tracked 的 target。 這是三種失效裡最隱蔽的一種：symlink 本身進了版控，target 內容沒有——clone 下來 symlink 在、skill 載不到，而且沒有任何錯誤訊息。agent 只是安靜地少了那個能力。
2026-08-02 實證： 與 各有 22 支第三方 skill 處於此狀態，symlink 指向
.agents/skills/<name>而該路徑從未存在（sync-to-codex 只投影.cursor/skills/的真實內容，本身是 symlink 的項目投影不過去）。兩個 repo 因此各少了 22 支 skill，時間長度不明——沒有機制會發現。
例外：node_modules-backed symlink
npx void init --agents 建的 void 與 migrate-vite-cloudflare-to-void 指向 node_modules/，pnpm virtual store 的 hash 跨機不同，進版控在別台機器必然斷鏈。這兩支維持 gitignore，fresh clone 後跑 void init --agents 重建。
判準是「target 在不在 repo 內」：指向 node_modules/ 的是例外，指向 repo 內任何位置的都不是。
機械稽核
scripts/audit-governance-drift.ts 的 check13 對每個 consumer 驗三件事，任一命中即 fail：
.agents/或.codex/有 tracked 檔.cursor/skills/tracked 檔數為 0（目錄存在卻整個沒進版控）- 有 symlink 形態的 skill 其 target 內容未 tracked
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 57 lines · 0 tokens per session scan A 8d1f556e7155
skill-management is a cursor rule published in the GitHub repository YuDefine/nuxt-supabase-starter (45 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,189 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other cursor rules, from other repositories
browser-extension
Browser extension patterns and development practices.
ci-patterns
CI/CD patterns and automation best practices.
process-management
Process management and zombie process prevention patterns.
test-setup-patterns
Test setup and configuration patterns.
coverage-thresholds
Coverage threshold configuration patterns.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.