Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pekral/cursor-rules --skill product-capabilitygit clone --depth 1 https://github.com/pekral/cursor-rulesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pekral/cursor-rules/product-capability)<a href="https://agentmods.dev/skills/pekral/cursor-rules/product-capability"><img src="https://agentmods.dev/badge/skills/pekral/cursor-rules/product-capability/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pekral/cursor-rules/product-capability"><img src="https://agentmods.dev/badge/skills/pekral/cursor-rules/product-capability.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00047 | $0.01138 |
| Opus 5.5 | $0.00019 | $0.00455 |
| Sonnet 5.5 | $0.00009 | $0.00228 |
| Haiku 4.5 | $0.00005 | $0.00114 |
Grade A, and why
product-capability scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 76 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Constraints
- Apply
@rules/laravel/architecture.mdc— actors, surfaces, states, and data model must fit the existing layers (Action → ModelService → Repository / ModelManager), not invent new abstractions. - Apply
@rules/compound-engineering/general.mdc— the plan is a durable artifact the next agent reuses, not throwaway prose. - Apply
@rules/compound-engineering/general.mdcAssign the most relevant existing label when creating a tracker issue for any tracker issue this plan creates or hands off to@skills/create-issues-from-text/SKILL.mdto create. - Do not invent product truth. Every unknown is an explicit open question, never a silent assumption.
- Separate user-visible promises from implementation detail. Keep them in distinct sections.
- Mark each constraint as fixed policy, architectural preference, or open question — never blur the three.
- Do not write code. The output is a plan, not an implementation.
- Use one language only. English here.
Use when
- A PRD exists but the implementation constraints stay implicit.
- The capability spans multiple surfaces or services and needs one contract.
- The product vision is clear yet its architectural implications are not.
- Engineering reviews keep surfacing the same hidden assumptions.
The gap is not "what should we build?" but "what exactly must be true before implementation starts?".
Execution
Walk these four steps in order. Each feeds the next.
-
Restate the capability precisely. Compress the ask into one statement covering the user (who gains the ability), the new ability (what they can now do), and the outcome change (what is true after that was not before). If you cannot fill all three, that is the first open question.
-
Extract the constraints. Surface what must hold regardless of design:
- business rules the capability must obey,
- scope boundaries (in scope vs explicitly out),
- invariants that must never break,
- trust boundaries and data ownership (who owns and may read/write the data; account scoping per
@rules/laravel/architecture.mdc), - lifecycle and state transitions,
- rollout / migration requirements. Tag every item as fixed policy, architectural preference, or open question.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 76 lines · 47 tokens per session scan A 57d0a82466dd
product-capability is a skill published in the GitHub repository pekral/cursor-rules (11 stars, last pushed 19d ago), licensed MIT. It adds 47 tokens to every session and 1,138 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
create-powergrid-plugin
Create a complete PowerGrid plugin from scratch, including PHP class, Column macro, Blade view, Alpine.js component, and registration.
Laravel Dusk Testing
Expert-level Laravel Dusk browser testing skill for PHP/Laravel applications. Covers Chrome-based E2E testing, browser assertions, Page Objects, component testing, authentication helpers, and database integration.
laravel
Use when building or extending a Laravel 11/12 app — Eloquent models, migrations and relationships, routing with controllers and Form Requests, queues and background jobs, framework-native security (validation, mass-assignment, policies, signed URLs, rate limiting), and Pest/PHPUnit feature tests. NOT pure PHP…
owl-admin-app-dev
Use this skill when developing an application that installed slowlyo/owl-admin, especially backend CRUD, menus, permissions, controllers, services, routes, config/admin.php, app/Admin, helper functions, settings(), adminpages(), AdminPipeline, upload/file preview issues, route conflicts, custom login/menu examples, or…
owl-admin-devtools-generator
A development guide for Owl Admin, a Laravel-based administration system, covering its code generator, API templates, relationships, and visual pages.
owl-admin-amis-page
A reference skill for building Owl Admin pages with amis, a system for defining admin interfaces such as forms, tables, filters, and actions through schemas.