Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pekral/cursor-rules --skill pr-summarygit clone --depth 1 https://github.com/pekral/cursor-rulesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pekral/cursor-rules/pr-summary)<a href="https://agentmods.dev/skills/pekral/cursor-rules/pr-summary"><img src="https://agentmods.dev/badge/skills/pekral/cursor-rules/pr-summary/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pekral/cursor-rules/pr-summary"><img src="https://agentmods.dev/badge/skills/pekral/cursor-rules/pr-summary.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00065 | $0.03936 |
| Opus 5.5 | $0.00026 | $0.01574 |
| Sonnet 5.5 | $0.00013 | $0.00787 |
| Haiku 4.5 | $0.00006 | $0.00394 |
Grade A, and why
pr-summary scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Constraint:
- Apply @rules/php/core-standards.mdc
- Apply @rules/git/general.mdc
- Apply @rules/jira/general.mdc when the target is a JIRA issue
- Apply @rules/reports/general.mdc — the published comment must be written in the language of the source assignment (Czech assignment → Czech comment; English assignment → English comment). Code identifiers stay verbatim per the rule's Scope clarifications.
- If the current project uses Laravel, also apply
@rules/laravel/laravel.mdc,@rules/laravel/architecture.mdc,@rules/laravel/filament.mdc, and@rules/laravel/livewire.mdc - Focus on the "why" and business impact, not on implementation details — but keep enough technical context (which integration, payload, table, endpoint, etc.) that a developer can still follow what changed.
- Do not include code snippets, file paths, line numbers, or diff fragments. The summary is for humans, not for static analysis.
- GitHub target only — always credit the real change author(s) (the JIRA non-technical comment omits the
Authorsline entirely; this metadata applies to the GitHub PR comment / linked-GitHub-issue mirror). Credit the real change author(s), not the agent or identity running the CR / publishing step. Extract authors from git commit history (git log --pretty='%an <%ae>' base..HEAD | sort -u) and from PR metadata (author.loginandcommits[].author.loginreturned byskills/code-review-github/scripts/load-issue.sh). When the target is GitHub, prefer@github-handle; when the target is JIRA, prefer the JIRA-account display name returned by the JIRA loader, otherwise fall back to the gitName <email>. Multiple authors are listed comma-separated in commit order. Never silently drop the Authors line — when authorship cannot be determined, write "Authors: unknown — git history did not yield a recognisable identity". - Always flag changes that are reachable only behind a test / opt-in parameter (feature flag, ENV switch, query-string parameter, request header, A/B variant, beta toggle, allow-listed account). When the diff shows a guard such as
config('feature.x'),env('SOMETHING_ENABLED'), GrowthBook / Unleash / LaunchDarkly check, a query-string?debug=, a request header gate, or a hard-coded allow-list, surface the exact toggle and the value required to reach the change: on the GitHub target as an "Available behind" line; on the JIRA target folded intoHow to teststep 1 (which enables the toggle before the tester proceeds). Omit it only when the change is reachable by every user unconditionally. - Every comment opens with a TL;DR. Both targets render a
TL;DRsection at the top of the body (directly below the{assignment_verdict}slot when one is rendered): one or two sentences, in the assignment language, naming what changed and why in plain language — the user-visible outcome, not the implementation. It must stand on its own, so a reader who stops there still knows what shipped. It is never omitted and never conditional. Keep it to two sentences: a TL;DR that grows into a paragraph is aSummary of changes, which the GitHub target already carries below and the JIRA target deliberately does not. - Output depends on the target tracker:
- GitHub target — output the three required sections plus the two metadata lines defined in
templates/pr-summary-github.md:TL;DR,Authors, the conditionalAvailable behind,Summary of changes, andHow to test. No categories, no breaking-changes section, no testing-notes section. - JIRA target — output only
TL;DRandHow to testplus the conditional embedded blocks (see below). The JIRA non-technical comment stays intentionally minimal: noAuthorsline, noSummary of changessection, noAvailable behindmetadata line. When the change is reachable only behind a test parameter, fold that toggle intoHow to teststep 1 instead of a separate line. The JIRA audience gets a two-sentence TL;DR and exactly how to test the change, and nothing else unless the wrapper passes a clarifying-questions or assignment-compliance block.
- GitHub target — output the three required sections plus the two metadata lines defined in
- No leaked markup on JIRA. When the target is JIRA, the rendered body must contain only JIRA Wiki Markup — never a Markdown control character that JIRA would show as literal text. Before publishing, scan the body and convert / reject any
**bold**/__bold__(→*bold*),#/##/###ATX headings (→h1./h2./h3.),`code`(→{{code}}), fenced```blocks (→{code}…{code}),-/+bullets (→*), and Markdown links[label]+(url)(→[label|url]) per@rules/jira/general.mdc. The reader must never see a raw**or#. - Embedded blocks (consolidation contract — issue #498): when the calling CR wrapper passes extra markdown blocks (the
Clarifying questionsblock and/or theAssignment Complianceblock returned by@skills/assignment-compliance-check/SKILL.md), append them verbatim afterHow to testand before the template's signature footer. Each embedded block must already be in the target tracker's markup (GitHub Markdown for GitHub, JIRA Wiki Markup for JIRA — the wrapper converts before passing). AClarifying questionsblock arrives already filtered by the wrapper per@rules/code-review/general.mdcClarifying Questions — Answered-Question Suppression & Severity Gate (issue #758) — questions the tracker thread already answered and the diff implements are gone, only Critical / Moderate ones remain, and no severity label or count is attached; append it as received and never re-rate, re-order, or annotate it. The resulting comment is published once per linked tracker target — that single consolidated comment is the only non-technical artifact a CR run posts on each linked issue or JIRA ticket. When no embedded blocks are passed, the template renders without that slot exactly as before. - Assignment / Functional verdict (top banner — affirmative exception, issue #737): whenever the calling CR wrapper passes an
Assignment Complianceembedded block — i.e. a tracker is linked and@skills/assignment-compliance-check/SKILL.mdran — render a single prominent verdict line at the very top of the comment (the{assignment_verdict}slot), in the assignment language, stating theGoal metoutcome and pointing to theAssignment Compliancedetail below: on a gap run, the non-compliance line naming the gap countN; on a clean run, the fully affirmative report naming the total acceptance-criteria countN. This guarantees the reader sees whether the assignment was met without scrolling to the appended block. DeriveNfrom the passed block'sGoal metverdict and the count of Not met / Partial / Divergent entries (gap run) or the total acceptance-criteria count (clean run). When noAssignment Complianceblock is passed (no tracker is linked), omit the slot entirely. Rendering the positive line on a clean run is the deliberate, narrow affirmative exception to the report-only-what-needs-action convention (@rules/code-review/general.mdcTwo-part CR output — Technical & Functional review), scoped to this banner alone.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 81 lines · 65 tokens per session scan A 633940549b4d
pr-summary is a skill published in the GitHub repository pekral/cursor-rules (11 stars, last pushed 19d ago), licensed MIT. It adds 65 tokens to every session and 3,936 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
Test Scaffold (Laravel/PHPUnit)
Generate PHP/Laravel (PHPUnit) test skeletons from specifications.
Laravel Eloquent N+1 and Query Efficiency Review
Detects N+1 query patterns (relation access inside loops without eager loading), full-table get()/all() loads, and unsafe chunk()/cursor() usage in Laravel Eloquent code.
Laravel Mass Assignment and Authorization Review
Detects mass assignment via create/update($request->all()), unguarded models, and missing authorization on mutating controller actions in Laravel.
Laravel Migration Safety Review
Reviews Laravel migrations for destructive operations, change() dropping modifiers, locking index creation on large tables (PostgreSQL), and asymmetric down().
knossos
Use when you need to know what depends on something, what a change would break, where a new file belongs, how a request reaches a given component, or who calls a function, in a repository that Knossos has scanned. Answers come from a static graph with file and line evidence instead of from reading the source tree.…
code-review-excellence
Master effective code review practices to provide constructive feedback, catch bugs early, and foster knowledge sharing while maintaining team morale. Use when reviewing pull requests, establishing review standards, or mentoring developers.