shelf: Skill for Cursor

.cursor/skills/shelf-register/SKILL.md

shelf-register is a skill for Cursor from ai-ventures-hub/shelf. It costs 57 tokens per session (1,531 once invoked), scanned A, original, MIT.

Instructions for registering a local project in Shelf, a macOS launcher for personal development tools.

In plain words
What is it for?
They are for adding or updating a project in Shelf, checking whether setup is needed, launching it, handling port conflicts, and inspecting launch errors.
Why use it?
They help save a project with its launch details so it can be started later without remembering terminal commands.

Skill for Cursor

Written for Cursor: installed under .cursor/. Also seen: mentions Codex.

This is ai-ventures-hub/shelf's own configuration. It tells Cursor how to work on shelf itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything shelf configures →

Reuse

Borrowing it

Nothing to install: this file belongs to ai-ventures-hub/shelf. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/ai-ventures-hub/shelf/main/.cursor/skills/shelf-register/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/ai-ventures-hub/shelf

Made for: Cursor.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for shelf-register

README.md
[![agentmods](https://agentmods.dev/badge/skills/ai-ventures-hub/shelf/shelf-register/github.svg)](https://agentmods.dev/skills/ai-ventures-hub/shelf/shelf-register)
Your own site
<a href="https://agentmods.dev/skills/ai-ventures-hub/shelf/shelf-register"><img src="https://agentmods.dev/badge/skills/ai-ventures-hub/shelf/shelf-register/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for shelf-register

Your own site · 80×15
<a href="https://agentmods.dev/skills/ai-ventures-hub/shelf/shelf-register"><img src="https://agentmods.dev/badge/skills/ai-ventures-hub/shelf/shelf-register.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 57 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,531 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00057 $0.01531
Opus 5 $0.00028 $0.00766
Sonnet 5 $0.00011 $0.00306
Haiku 4.5 $0.00006 $0.00153

Measured 10d ago against content hash 63f40127de38, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

shelf-register scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/skills/shelf-register/SKILL.md · 101 lines

How it starts

The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Register a project in Shelf

Shelf is a macOS personal command center for local tools. After a project is built, register it so the user can launch it later without remembering commands.

Prerequisites

  • Shelf MCP server configured in the client (Shelf → MCP Connections → Connect Claude / Cursor / Codex)
  • Prefer absolute project paths

Fast path (preferred)

Call shelf_register_project with the absolute projectPath — it inspects, saves (idempotently: re-registering the same folder updates instead of duplicating), and launches in one call with onPortConflict: "reassign" by default. Read the outcome:

  • launched — done; report the tool id and URL.
  • needs_setup — dependencies missing (e.g. no node_modules). Ask the user, then call again with runSetup: true; setup never runs without that flag.
  • saved_needs_review — detection was not confident. Fall back to the manual workflow below to confirm the launch command, then shelf_upsert_tool.
  • saved_launch_failed — inspect state.code (e.g. deps_missing, port_timeout, bad_launch_command) and shelf_get_logs, then fix.
  • Use dryRun: true to preview the gate without saving anything.

After a successful register, still add capabilities and verify agentAccess via shelf_upsert_tool when the tool offers agent interfaces — the fast path does not auto-generate capability phrases.

Manual workflow (fine-grained control)

  1. Call shelf_inspect_project with the absolute projectPath for suggested name, launchCommand, port/url, tags, and DESIGN.md signals. Review signals / confidence before trusting the draft.
  2. Check for a project-local DESIGN.md (Community bridge for agents):
    • Prefer the inspect result (designMd), or call shelf_get_design_md with the tool id or projectPath.
    • When found: true, read it and follow its tokens/guidance for UI work in that project.
    • Resource URI: shelf://tools/{id}/design-md
    • Missing DESIGN.md is normal — do not treat as an error.
  3. Confirm the port (web apps):
    • Inspect already prefers a free port when the framework default is busy; still call shelf_find_free_port if you need more candidates.
    • Keep port and url in sync (http://127.0.0.1:<port>/).
  4. Draft a Shelf tool config (start from inspect suggestions):
    • name: short product name
    • description: one or two sentences
    • projectPath: absolute folder path
    • launchCommand:
      • Python with venv → .venv/bin/python app.py (not bare python3 when Flask/deps live in .venv)
      • Node / Next → npm run dev -- --port <port> (or pnpm / yarn / bun equivalent)
      • Vite → npm run dev -- --port <port>
      • Docker → docker compose up
    • port / url when it is a local web app (must match the launch flags)
    • tags: small set (e.g. Image Tools, Client Projects)
    • capabilities: short task phrases an agent can match (e.g. batch optimize images, convert images to WebP)
    • agentAccess: declare only real CLI, MCP, or HTTP API interfaces the tool itself exposes; mark setupRequired honestly. Never include credentials. shelf_inspect_project suggests detected interfaces in its agentAccess response field — verify before saving. Omitting it is fine for GUI-only tools and limits NOTHING: shelf_launch_tool / shelf_stop_tool work for every registered tool. A manual_only readiness means "no child interface declared", never "cannot launch".
    • notes: inputs, common errors, last known working setup
  5. Show the draft to the user and get confirmation before writing.
  6. Call MCP shelf_upsert_tool with the confirmed fields.
    • Read warnings / suggestedPort in the response. If present, re-upsert on the suggested port (or pass autoFixPort: true) — do not treat a busy-port upsert as fully healthy.
  7. Optionally call shelf_launch_tool — it works regardless of readiness state or agentAccess. Prefer shelf_stop_tool when finished so the GUI is not left with an orphaned listener. If you need a second instance while the port is busy, use onPortConflict: "reassign" (Shelf picks a free port, rewrites launch/url, and persists). Default launch adopts an already-listening port instead of erroring.
  8. Verify with shelf_get_logs / shelf_get_status.
  9. Tell the user the tool id and how to find it in the Shelf GUI library.

Read the full file on GitHub · 101 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 10d ago First seen · 101 lines · 57 tokens per session scan A 63f40127de38

Subscribe to this mod's changes

shelf-register is a skill published in the GitHub repository ai-ventures-hub/shelf (2 stars, last pushed 14d ago), licensed MIT. It adds 57 tokens to every session and 1,531 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.