Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/pekral/cursor-rules/product-capabilitynpx skills add pekral/cursor-rules --skill product-capabilitygit clone --depth 1 https://github.com/pekral/cursor-rulesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pekral/cursor-rules/product-capability)<a href="https://agentmods.dev/skills/pekral/cursor-rules/product-capability"><img src="https://agentmods.dev/badge/skills/pekral/cursor-rules/product-capability.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00047 | $0.01138 |
| Opus 5 | $0.00023 | $0.00569 |
| Sonnet 5 | $0.00009 | $0.00228 |
| Haiku 4.5 | $0.00005 | $0.00114 |
Grade A, and why
product-capability scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 76 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Constraints
- Apply
@rules/laravel/architecture.mdc— actors, surfaces, states, and data model must fit the existing layers (Action → ModelService → Repository / ModelManager), not invent new abstractions. - Apply
@rules/compound-engineering/general.mdc— the plan is a durable artifact the next agent reuses, not throwaway prose. - Apply
@rules/compound-engineering/general.mdcAssign the most relevant existing label when creating a tracker issue for any tracker issue this plan creates or hands off to@skills/create-issues-from-text/SKILL.mdto create. - Do not invent product truth. Every unknown is an explicit open question, never a silent assumption.
- Separate user-visible promises from implementation detail. Keep them in distinct sections.
- Mark each constraint as fixed policy, architectural preference, or open question — never blur the three.
- Do not write code. The output is a plan, not an implementation.
- Use one language only. English here.
Use when
- A PRD exists but the implementation constraints stay implicit.
- The capability spans multiple surfaces or services and needs one contract.
- The product vision is clear yet its architectural implications are not.
- Engineering reviews keep surfacing the same hidden assumptions.
The gap is not "what should we build?" but "what exactly must be true before implementation starts?".
Execution
Walk these four steps in order. Each feeds the next.
-
Restate the capability precisely. Compress the ask into one statement covering the user (who gains the ability), the new ability (what they can now do), and the outcome change (what is true after that was not before). If you cannot fill all three, that is the first open question.
-
Extract the constraints. Surface what must hold regardless of design:
- business rules the capability must obey,
- scope boundaries (in scope vs explicitly out),
- invariants that must never break,
- trust boundaries and data ownership (who owns and may read/write the data; account scoping per
@rules/laravel/architecture.mdc), - lifecycle and state transitions,
- rollout / migration requirements. Tag every item as fixed policy, architectural preference, or open question.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 76 lines · 47 tokens per session scan A 57d0a82466dd
product-capability is a skill published in the GitHub repository pekral/cursor-rules (6 stars, last pushed 8d ago), licensed MIT. It adds 47 tokens to every session and 1,138 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
parse-table
Parse table definition to extract module name, model name, table name, and field definitions. First step of CRUD generation.
owl-admin-ops-commands
Use this skill for Owl Admin installation, publishing assets, upgrades, diagnostics, database inspection, menu maintenance, user creation, password reset, route generation, IDE helper, admin:publish, admin:install, admin:update, admin:doctor, admin:db, admin:menu, admin:create-user, or deployment troubleshooting.
octane-development
Use this skill when working with Laravel Octane, a long-running PHP worker server (Swoole, FrankenPHP, RoadRunner) where the application boots once and serves many requests instead of rebooting for each request like PHP-FPM. Trigger when installing Octane or starting its server; configuring or detecting the active…
pulse-development
Handles Laravel Pulse setup, configuration, and custom card development. Activates when installing Pulse; configuring the dashboard or authorization gate; setting up recorders and filtering; building custom Livewire cards; optimizing with Redis ingest or sampling; or when the user mentions /pulse, pulse:check…
module:assistant
Add an AI assistant chat panel to any Laravel project — with tool calling, streaming, and MCP support.
request-review
Dispatch a fresh reviewer agent with a clean context to critique the code after audit-code passes. The reviewer has no shared state with the coding agent and gives a genuine second opinion. Use after audit-code passes, before committing, or when user wants an independent code review.