Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/Zenobia000/cursor-agentic-coding-templateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/zenobia000/cursor-agentic-coding-template/global)<a href="https://agentmods.dev/rules/zenobia000/cursor-agentic-coding-template/global"><img src="https://agentmods.dev/badge/rules/zenobia000/cursor-agentic-coding-template/global/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/zenobia000/cursor-agentic-coding-template/global"><img src="https://agentmods.dev/badge/rules/zenobia000/cursor-agentic-coding-template/global.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01158 | $0.01158 |
| Opus 5.5 | $0.00463 | $0.00463 |
| Sonnet 5.5 | $0.00232 | $0.00232 |
| Haiku 4.5 | $0.00116 | $0.00116 |
Grade A, and why
global scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- global — 100% identical, 0 lines differ
What it actually says
🔥 核心開發原則
語言與框架
- 主要語言: TypeScript (strict mode), Python 3.10+
- 禁止使用 any：型別必須明確定義
- 優先使用函數式編程：純函數、不可變數據
- 錯誤處理：必須有 try-catch 或 Result pattern
程式碼品質
- 單一職責原則：每個函數/類別只做一件事
- DRY 原則：重複邏輯必須抽取
- 命名規範：
- 變數/函數：camelCase
- 類別/型別：PascalCase
- 常數：UPPER_SNAKE_CASE
- 檔案：kebab-case
輸出格式
- 改動前必須：先列出變更清單
- 提供程式碼時：使用 diff 格式或完整區塊
- 說明改動原因：每個變更都要有理由
⚡ 架構邊界（絕對不可跨越）
前後端分離
- 前端禁止直接存取：
- 資料庫連線
- 環境變數 (除了 PUBLIC_ 開頭)
- 檔案系統操作
- 第三方 API 金鑰
API 設計
- RESTful 原則：正確使用 HTTP 動詞
- 資料驗證：前後端都要驗證
- 錯誤處理：統一的錯誤格式
- 版本控制：API 路徑包含版本號
資料流向
- 單向數據流：State → View → Action → State
- 不可變更新：使用 spread operator 或 immer
- 狀態管理：集中式管理（Redux/Zustand/Jotai）
🛡️ 安全紅線
絕對禁止
- ❌ 硬編碼密鑰：所有 secret 必須用環境變數
- ❌ SQL 注入：使用參數化查詢或 ORM
- ❌ XSS 攻擊：所有用戶輸入必須 sanitize
- ❌ 未加密傳輸：敏感資料必須 HTTPS/WSS
輸入驗證
- 永不信任客戶端：所有輸入都視為惡意
- 白名單驗證：只允許預期的輸入
- 長度限制：防止 DoS 攻擊
- 類型檢查：使用 zod/yup/joi 驗證
AI 特殊規則
- Prompt 注入防護：用戶輸入不可覆蓋系統指令
- 輸出驗證：LLM 回應必須結構化驗證
- Token 限制：設定最大 token 數
- 成本追蹤：記錄每次 API 呼叫成本
🚀 效能要求
前端效能
- 首次載入 < 3s：使用 code splitting
- 互動延遲 < 100ms：優化重渲染
- 圖片優化：使用 WebP/AVIF，lazy loading
- 快取策略：使用 Service Worker
後端效能
- API 回應 < 200ms：優化查詢，使用快取
- 資料庫查詢：使用索引，避免 N+1
- 並發處理：使用 worker/cluster
- 限流保護：實施 rate limiting
📝 文檔與測試
必要文檔
- README：專案說明、安裝步驟、使用方式
- API 文檔：使用 OpenAPI/Swagger
- 架構決策記錄 (ADR)：重要決策都要記錄
測試要求
- 單元測試覆蓋率 > 80%
- 整合測試：關鍵流程必須測試
- E2E 測試：核心使用者路徑
- 測試命名：describe what, not how
🎯 Git 規範
Commit 訊息
type(scope): subject
body (optional)
footer (optional)
- type: feat/fix/docs/style/refactor/test/chore
- scope: 影響範圍
- subject: 簡短描述（祈使句）
分支策略
- main/master：生產環境
- develop：開發環境
- feature/：新功能
- fix/：修復錯誤
- release/：版本發布
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 114 lines · 1,158 tokens per session scan A a3ddb86e4a59
global is a cursor rule published in the GitHub repository Zenobia000/cursor-agentic-coding-template (30 stars, last pushed 4mo ago), licensed MIT. It adds 1,158 tokens to every session, about $0.0046 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
prefer-direct-imports-over-module-mocks
Prefer extracting a testable core over vi.mock / vi.resetModules when unit tests need to reach production logic entangled with config, env, or singletons.
config-validation-and-normalization
Config validation and normalization responsibilities (defineConfig normalizes, the orm section schema validates and resolves paths, the loader reports per-section diagnostics).
control-plane-descriptors
Control plane descriptor and instance implementation patterns.