Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pekral/cursor-rules --skill tester-cookbookgit clone --depth 1 https://github.com/pekral/cursor-rulesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pekral/cursor-rules/tester-cookbook)<a href="https://agentmods.dev/skills/pekral/cursor-rules/tester-cookbook"><img src="https://agentmods.dev/badge/skills/pekral/cursor-rules/tester-cookbook/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pekral/cursor-rules/tester-cookbook"><img src="https://agentmods.dev/badge/skills/pekral/cursor-rules/tester-cookbook.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00049 | $0.02585 |
| Opus 5.5 | $0.00020 | $0.01034 |
| Sonnet 5.5 | $0.00010 | $0.00517 |
| Haiku 4.5 | $0.00005 | $0.00259 |
Grade A, and why
tester-cookbook scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 109 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Constraints
- Apply
@rules/php/core-standards.mdc - Apply
@rules/git/general.mdc - Apply
@rules/jira/general.mdc— JIRA comments must be in Wiki Markup, never Markdown - Apply
@rules/reports/general.mdc— the cookbook JIRA comment must be written in the language of the JIRA task description (e.g.ECOMAIL-*tasks → Czech). Do not mix languages within a single comment; UI-visible labels stay verbatim as they appear in the admin screen. - Read-only relative to the codebase. The skill never modifies code; it only publishes a JIRA comment.
- Never change the JIRA task status — per
@rules/jira/general.mdc, status transitions are handled by humans only. - The audience is an internal QA tester who is not a programmer. Everything in the report must be verifiable by clicking in the application, opening a report screen, reading a delivered email/SMS, or checking the account balance. Anything that cannot be verified that way belongs in the dev-team report as a flag for the development team, not as a tester action.
- Forbidden vocabulary in the comment body — replace with a UI-visible label before publishing:
- infrastructure:
queue,lambda,SQS,ENV,.env,config,feature flag(use switch in Administration),job,dispatch,retry,polling,telemetry,log,Bugsnag,Slack(unless the Slack notification is what the tester reads),AWS,payload,endpoint,API v2(unless that exact wording appears in the UI). - code identifiers:
enum,class,namespace,repository,action,table,column, DB column name, migration, route, status code, event name, listener.
- infrastructure:
- No code identifiers in the comment. When the PR diff references a code-level value (for example
CampaignLogEvent::SMS_ACCEPTED), translate it to the exact label the tester sees in the UI ("status Waiting for delivery in the campaign report"). - No credentials. When a test account is required, refer to it by its tester-facing alias ("use test account
qa-cz-1— ask devs for access if you don't have it"), never quote a password or API key. - Concrete inputs. Replace generic phrasing with the literal value the tester should type. Instead of "use a valid number" write "use the test number
+420604240203". - Validate the final comment before publishing: it must not contain any forbidden token, any Markdown heading (
#), any fenced code block (```), or any Markdown table (|).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 109 lines · 49 tokens per session scan A 4319dcfe79ae
tester-cookbook is a skill published in the GitHub repository pekral/cursor-rules (11 stars, last pushed 19d ago), licensed MIT. It adds 49 tokens to every session and 2,585 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
Laravel Dusk Testing
Expert-level Laravel Dusk browser testing skill for PHP/Laravel applications. Covers Chrome-based E2E testing, browser assertions, Page Objects, component testing, authentication helpers, and database integration.
trace-requirement
Link story IDs from specs/release-plan.yaml + epic capsule directories to the implementing code and tests. Produces specs/TRACEABILITYLATEST.md. Use when you want to verify coverage of a release plan, audit which stories are implemented, or find "dark" stories with no code.
php-laravel
Use this skill when building Laravel applications — MVC structure, Eloquent ORM, service layer, validation, queues, and testing. This skill enforces: thin controllers, service layer for business logic, Eloquent best practices with eager loading, form request validation, and queue job structure. Requires Laravel 10+ or…
Test Scaffold (Laravel/PHPUnit)
Generate PHP/Laravel (PHPUnit) test skeletons from specifications.
laravel-testing
Test strategy for a layered Laravel application — which test style fits each layer, hand-written fakes over mocks, real-database tests for Query Classes and Repositories, pure tests for Value Objects, and feature tests that assert authorization, payload shape and query counts. Use when writing or reviewing Laravel…
role-产品开发协调者
A product-development coordinator role that identifies the kind of work requested, chooses the order of tasks, and assigns the right specialist roles.