The rules real projects give Cursor's agent, from .cursor/rules.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
ReefJediCursor ruleReefJedi/coding-agent-prompts/.cursor/rules/code-reviewer.mdc
Senior code reviewer. Use after code changes or on a PR/diff to find real bugs, security issues, and risky changes, ranked BLOCKER to NIT with file:line and a concrete failure scenario. Read-only.
andr-caReads credentialsCursor ruleandr-ca/agentharness/.cursor/rules/docker-conventions.mdc
Use when writing a Dockerfile, docker-compose file, or CI containerization config — multi-stage builds, layer caching, security (non-root user, minimal base images, no secrets in layers), and health checks.
VoTruongDanhCursor ruleVoTruongDanh/Skills-Agent/.cursor/rules/enhance.mdc
Improve existing code — refactor, optimize performance, tighten security, or enhance UX. Use when the user wants to make code better without changing its purpose. Triggers: enhance, improve, refactor, optimize, review, cải thiện, tối ưu, nhanh hơn, code dài quá.
darknecrocitiesCursor ruledarknecrocities/SkillBuilder/.cursor/rules/qa.mdc
Comprehensive Two-Tier Quality Assurance skill. Features Full UI/Frontend QA (viewports, touch ergonomics, WCAG 2.2 AA, sub-pixel lighting, 120Hz compositor) and Full App Functional QA (state machines, real persistence, 3s/15s network resilience, mobile OS lifecycle, memory leaks, security, and Master Error Catalog).
elevationgainCursor ruleelevationgain/agent-disco/.cursor/rules/activate-simon.mdc
Bring in Simon, the Director of Engineering / Solution Architect support persona for architecture, reliability, security, and delivery trade-off recommendations. Use when the user says "Activate Simon", "Bring in Simon", or asks for architectural guidance grounded in industry context.
abxn4rCursor ruleabxn4r/archon-skills/.cursor/rules/council.mdc
Autonomous Multi-Advisor Consensus Council orchestrating Seneca (Strategy), Dijkstra (Architecture), Saltzer (Security & Release Veto), Aperture (UI/UX), Caples (Copy), and Orwell (Growth) on high-stakes decisions, migrations, and architecture changes. Produces a unified Consensus & Disagreements Matrix.
MANVENDRA-githubCursor ruleMANVENDRA-github/agentry/.cursor/rules/code-review.mdc
Self-review discipline for in-conversation use — apply before declaring code complete or before committing. Walks correctness, security, maintainability, and convention checks at the time of writing. For focused review of a large diff in a fresh context, delegate to the code-reviewer agent.
Often used withadd-new-model
mchittineniCursor rulemchittineni/cloud-platform-skills/.cursor/rules/skills/secops-incident-triage-forensics.mdc
Security incident response: compromise triage, cloud instance and credential containment, forensic disk and memory capture with chain of custody, IAM session and key revocation, and SIEM correlation for threat hunting. Use when a host, container or cloud credential is suspected compromised, when a leaked access key found in a public repository has already been used, or when capturing evidence.
mchittineniCursor rulemchittineni/cloud-platform-skills/.cursor/rules/skills/cicd-pipeline-design.mdc
CI/CD pipeline architecture for GitHub Actions and GitLab CI: matrix testing, dependency caching, OIDC keyless cloud authentication, security gating, and concurrency control. Use when a pipeline is slow because every job reinstalls dependencies, when long-lived AWS or cloud access keys stored as CI secrets must be removed, or when building, gating and speeding up a build-test-deploy workflow.
mchittineniReads credentialsCursor rulemchittineni/cloud-platform-skills/.cursor/rules/skills/shift-left-security-sast-sca.mdc
Shift-left security automation: Semgrep SAST, Trivy and Snyk dependency and image scanning, Gitleaks repository scans for committed credentials, and SBOM generation in CycloneDX or SPDX format. Use when adding code, dependency or image scanning to a CI pipeline, when a scanner reports hundreds of findings that developers now ignore and gates need tuning for false positives, or when a customer or auditor asks for an SBOM produced by the build.
mchittineniCursor rulemchittineni/cloud-platform-skills/.cursor/rules/skills/supply-chain-security-slsa-sigstore.mdc
Software supply chain security: keyless Sigstore/cosign signing with OIDC, SLSA build levels, in-toto provenance attestations, SBOM attestation, and signature plus identity verification enforced at Kubernetes admission with Kyverno or the sigstore policy-controller. Use when release artifacts or container images need signing, provenance or attestation, when a customer or auditor asks which SLSA level a build meets, or when only trusted and verified images should be allowed to run in a cluster.
mchittineniCursor rulemchittineni/cloud-platform-skills/.cursor/rules/skills/policy-as-code-opa-kyverno.mdc
Policy as code for Kubernetes and infrastructure: authoring Kyverno ClusterPolicy rules, OPA Rego in a Gatekeeper ConstraintTemplate, and Conftest checks, plus Pod Security Standards enforcement, policy unit testing, and an owned exception register with expiry dates. Use when privileged containers or pods without resource limits must be rejected at admission rather than reported, when admission policies need tests so a rule cannot silently stop matching, or when choosing between Kyverno and OPA Gatekeeper.
Surya8991Cursor ruleSurya8991/AgentMaster/.cursor/rules/repomix-pack.mdc
Packs the entire codebase (or selected folders) into a single token-efficient file using repomix, so other skills can analyze the whole repo without re-reading individual files. Use when the task requires whole-codebase context: full security audits, cross-cutting refactors, architecture review, project-wide code review, or first-time onboarding to an unfamiliar repo. Auto-runs once per session at first invocation of agent-master.
mchittineniCursor rulemchittineni/cloud-platform-skills/.cursor/rules/skills/detection-engineering-threat-hunting.mdc
Detection engineering and threat hunting: detection-as-code with Sigma rules in version control, log pipeline and telemetry source coverage, MITRE ATT&CK coverage mapping, alert precision and tuning to survive analyst trust, validation with Atomic Red Team, and hypothesis-driven hunts for activity that evaded automated controls. Use when security alerts are too noisy to act on, when deciding which detections to write and which telemetry to collect first, or when hunting for attacker activity nothing has alerted on.
Zulut30Cursor ruleZulut30/dart-mobile-game-studio/.cursor/rules/agents/security-auditor.mdc
Security & privacy auditor for Flutter/Dart mobile games (iOS + Android). Use to find data leaks, insecure storage/network, hardcoded secrets, over-broad permissions (Android INTERNET/location/AD_ID, iOS usage strings), unsafe APIs, and kids-privacy violations — tracking, ads (google_mobile_ads), analytics/Crashlytics, AdvertisingId (IDFA/GAID), Firebase telemetry, external links — across BOTH Apple Kids Category and Google Play Families. Read-only: reports risks and concrete fixes, never edits.
mchittineniCursor rulemchittineni/cloud-platform-skills/.cursor/rules/skills/ai-agent-security-llm-threats.mdc
Security for LLM and agent systems: direct and indirect prompt injection, the OWASP Top 10 for LLM Applications, MITRE ATLAS technique mapping, excessive agency and tool-scope containment, egress allowlisting to stop data exfiltration, human confirmation for irreversible actions, and treating third-party skills and MCP servers as untrusted code. Use when an agent is given tools or credentials, when retrieved documents or repository files could carry injected instructions, or when reviewing an AI feature before it reaches production.
anmolnagpalCursor ruleanmolnagpal/devops-skills/.cursor/rules/logging.mdc
Review whether security-relevant logging is enabled, complete, shipped off-host, and tamper-resistant across Kubernetes and the cloud control plane. Use when user says 'review my audit logging', 'is audit logging on', 'check my k8s audit policy', 'are we logging API-server access', 'review GKE/AKS logging', 'do we capture admin activity', or when working in audit-policy.yaml, kube-apiserver manifests, or GKE/AKS Terraform. Covers generic Kubernetes audit policy, GKE Cloud Logging + audit config, AKS diagnostic settings, and cross-cloud audit-log immutability. For AWS CloudTrail/flow-log/EKS-audit/S3-access IaC use /clouddrove:tf (SEC-LOG-*); for log retention/centralization, metrics, and SLOs use /clouddrove:observability (OBS-LOG-*).
jeaninejiangCursor rulejeaninejiang/shipping-skills/.cursor/rules/supabase-rls-data-model.mdc
Design Postgres tables, Row Level Security policies and migrations for a Supabase app where data is shared between users — couples, teams, households, invites, join codes, anything two or more accounts touch. Use this whenever you are creating or changing a Supabase table, writing or debugging an RLS policy, adding an invite/pairing/join flow, or investigating why a query returns nothing for one user but works for another. Reach for it early: RLS decisions are cheap to make correctly up front and expensive to unpick once rows exist, and the most common failure mode is a silent empty result rather than an error.
MANVENDRA-githubReads credentialsCursor ruleMANVENDRA-github/agentry/.cursor/rules/secrets-management.mdc
Handle a secret across its whole lifecycle — keep it out of source and image layers, inject it at runtime via environment or a secret store, scope each credential to least privilege, and rotate on a schedule and immediately after exposure. Invoke when code needs an API key, DB password, token, or private key, or when wiring how an app obtains its secrets. Complements the secret-scan hook (which only blocks committing a literal) and security-review (which only flags secrets in your diff). Skip for code that handles no credentials.
adammatthewsteinbergerCursor ruleadammatthewsteinberger/claudeloop/.cursor/rules/claudeloop-quality-gates.mdc
Covers how to run and FIX every quality gate in this repo — ruff (lint + format), mypy --strict, pytest with per-layer coverage, import-linter (lint-imports), bandit, and pip-audit. Use this whenever a quality gate fails locally or in CI, whenever the user asks how to lint, format, type-check, or run security scans on this codebase, or before opening a PR to run the full gate set proactively. Make sure to consult this whenever a ruff, mypy, lint-imports, or bandit error appears in tool output — it gives the exact fix command for each gate rather than requiring you to guess at generic remediation.
Instruction files for Cursor's agent, kept in .cursor/rules/ as .mdc files.
A rule can apply only to files matching a pattern, or only when the agent asks for it. AGENTS.md always applies.
Copy the .mdc file into your project's .cursor/rules/ directory and adjust its globs.
Open a rule to see its discussion. Reports from people and their agents are coming.
