The rules real projects give Cursor's agent, from .cursor/rules.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
anmolnagpalReads credentialsCursor ruleanmolnagpal/devops-skills/.cursor/rules/github-actions.mdc
GitHub Actions workflow review, scaffolding, and security hardening. Use when user says 'review my workflow', 'check my actions', 'scaffold a workflow', 'is my CI correct', 'pin actions', 'OIDC to AWS', or when working in .github/workflows/*.yml files.
codegobrrrr9Reads credentialsCursor rulecodegobrrrr9/seatbelt/.cursor/rules/seatbelt.mdc
seatbelt — pre-ship safety rules. Stops secrets in client code or git, tables without row security, routes without auth, open CORS, unverified webhooks.
Fadi88Cursor ruleFadi88/one-man-startup/.cursor/rules/agent-security.mdc
Reviews designs and diffs for security and privacy risk - auth, access control, secrets, injection, dependencies, data exposure. It writes its report and never changes code. Use on any feature touching accounts, payments, personal data, file upload or a new integration.
PsylinksSecurityWebCursor rulePsylinksSecurityWeb/PsyLinks-360-Security/.cursor/rules/psylinks-360-security.mdc
Apply PsyLinks 360° Security Review when working on authentication, APIs, backend services, databases, secrets, dependencies, deployment, or AI-agent/MCP workflows.
galyarderlabsCursor rulegalyarderlabs/galyarder-framework/.cursor/rules/audit-website.mdc
Audit websites for SEO, performance, security, technical, content, and 15 other issue cateories with 230+ rules using the squirrelscan CLI. Returns LLM-optimized reports with health scores, broken links, meta tag analysis, and actionable recommendations. Use to discover and asses website or webapp issues and health.
wuisabel-gifCursor rulewuisabel-gif/HAL/.cursor/rules/capability-security-review.mdc
Capability-security review of PRs, diffs, or third-party/plugin code — apply when reviewing pull requests, auditing contributed code, or judging whether code is safe.
andr-caReads credentialsCursor ruleandr-ca/agentharness/.cursor/rules/code-review.mdc
Use when reviewing a diff, pull request, or code change — systematic checklist for correctness, clarity, security, testability, and adherence to the project's conventions. Covers what to look for, how to give actionable feedback, and when to approve vs. request changes.
vantionlabsCursor rulevantionlabs/saas-starter/.cursor/rules/effect-sql-rls.mdc
Use when writing any query, migration, or test that touches tenant data in this repository. Covers withOrgScope and withWorkerScope, the two Postgres roles and why the boundary is in the database rather than in a lint rule, the shape a row-level security policy has to take, when Effect.orDie is right, and why a fixture seeds through the product's own write path.
abxn4rReads credentialsCursor ruleabxn4r/archon-skills/.cursor/rules/saltzer.mdc
ALWAYS invoke when the user mentions Saltzer (e.g., 'Saltzer', 'ask Saltzer', 'run Saltzer', 'consult Saltzer') or asks for security review, vulnerability assessment, pen-testing, or pre-release audit. Principal Application
ReefJediCursor ruleReefJedi/coding-agent-prompts/.cursor/rules/code-reviewer.mdc
Senior code reviewer. Use after code changes or on a PR/diff to find real bugs, security issues, and risky changes, ranked BLOCKER to NIT with file:line and a concrete failure scenario. Read-only.
andr-caReads credentialsCursor ruleandr-ca/agentharness/.cursor/rules/docker-conventions.mdc
Use when writing a Dockerfile, docker-compose file, or CI containerization config — multi-stage builds, layer caching, security (non-root user, minimal base images, no secrets in layers), and health checks.
VoTruongDanhCursor ruleVoTruongDanh/Skills-Agent/.cursor/rules/enhance.mdc
Improve existing code — refactor, optimize performance, tighten security, or enhance UX. Use when the user wants to make code better without changing its purpose. Triggers: enhance, improve, refactor, optimize, review, cải thiện, tối ưu, nhanh hơn, code dài quá.
darknecrocitiesCursor ruledarknecrocities/SkillBuilder/.cursor/rules/qa.mdc
Comprehensive Two-Tier Quality Assurance skill. Features Full UI/Frontend QA (viewports, touch ergonomics, WCAG 2.2 AA, sub-pixel lighting, 120Hz compositor) and Full App Functional QA (state machines, real persistence, 3s/15s network resilience, mobile OS lifecycle, memory leaks, security, and Master Error Catalog).
elevationgainCursor ruleelevationgain/agent-disco/.cursor/rules/activate-simon.mdc
Bring in Simon, the Director of Engineering / Solution Architect support persona for architecture, reliability, security, and delivery trade-off recommendations. Use when the user says "Activate Simon", "Bring in Simon", or asks for architectural guidance grounded in industry context.
abxn4rCursor ruleabxn4r/archon-skills/.cursor/rules/council.mdc
Autonomous Multi-Advisor Consensus Council orchestrating Seneca (Strategy), Dijkstra (Architecture), Saltzer (Security & Release Veto), Aperture (UI/UX), Caples (Copy), and Orwell (Growth) on high-stakes decisions, migrations, and architecture changes. Produces a unified Consensus & Disagreements Matrix.
MANVENDRA-githubCursor ruleMANVENDRA-github/agentry/.cursor/rules/code-review.mdc
Self-review discipline for in-conversation use — apply before declaring code complete or before committing. Walks correctness, security, maintainability, and convention checks at the time of writing. For focused review of a large diff in a fresh context, delegate to the code-reviewer agent.
Often used withclose-specadd-new-modelcompare-screenshots
mchittineniCursor rulemchittineni/cloud-platform-skills/.cursor/rules/skills/secops-incident-triage-forensics.mdc
Security incident response: compromise triage, cloud instance and credential containment, forensic disk and memory capture with chain of custody, IAM session and key revocation, and SIEM correlation for threat hunting. Use when a host, container or cloud credential is suspected compromised, when a leaked access key found in a public repository has already been used, or when capturing evidence.
mchittineniCursor rulemchittineni/cloud-platform-skills/.cursor/rules/skills/cicd-pipeline-design.mdc
CI/CD pipeline architecture for GitHub Actions and GitLab CI: matrix testing, dependency caching, OIDC keyless cloud authentication, security gating, and concurrency control. Use when a pipeline is slow because every job reinstalls dependencies, when long-lived AWS or cloud access keys stored as CI secrets must be removed, or when building, gating and speeding up a build-test-deploy workflow.
mchittineniReads credentialsCursor rulemchittineni/cloud-platform-skills/.cursor/rules/skills/shift-left-security-sast-sca.mdc
Shift-left security automation: Semgrep SAST, Trivy and Snyk dependency and image scanning, Gitleaks repository scans for committed credentials, and SBOM generation in CycloneDX or SPDX format. Use when adding code, dependency or image scanning to a CI pipeline, when a scanner reports hundreds of findings that developers now ignore and gates need tuning for false positives, or when a customer or auditor asks for an SBOM produced by the build.
mchittineniCursor rulemchittineni/cloud-platform-skills/.cursor/rules/skills/supply-chain-security-slsa-sigstore.mdc
Software supply chain security: keyless Sigstore/cosign signing with OIDC, SLSA build levels, in-toto provenance attestations, SBOM attestation, and signature plus identity verification enforced at Kubernetes admission with Kyverno or the sigstore policy-controller. Use when release artifacts or container images need signing, provenance or attestation, when a customer or auditor asks which SLSA level a build meets, or when only trusted and verified images should be allowed to run in a cluster.
Instruction files for Cursor's agent, kept in .cursor/rules/ as .mdc files.
A rule can apply only to files matching a pattern, or only when the agent asks for it. AGENTS.md always applies.
Copy the .mdc file into your project's .cursor/rules/ directory and adjust its globs.
Open a rule to see its discussion. Reports from people and their agents are coming.
