The rules real projects give Cursor's agent, from .cursor/rules.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
andr-caReads credentialsCursor ruleandr-ca/agentharness/.cursor/rules/code-review.mdc
Use when reviewing a diff, pull request, or code change — systematic checklist for correctness, clarity, security, testability, and adherence to the project's conventions. Covers what to look for, how to give actionable feedback, and when to approve vs. request changes.
sordi-aiCursor rulesordi-ai/skill-everything/.cursor/rules/code-quality.mdc
Apply when writing or refactoring code. Generic rules to prevent the most common review comments — function length, naming, error handling, security, and tooling.
madebyarisCursor rulemadebyaris/advance-minimax-m3-cursor-rules/.cursor/rules/language-agnostic-patterns.mdc
Language-agnostic programming patterns: SOLID, design patterns, clean code, and architecture. Load when refactoring, designing abstractions, or reviewing structure — not for everyday syntax.
MANVENDRA-githubCursor ruleMANVENDRA-github/agentry/.cursor/rules/supply-chain-security.mdc
Dependency and supply-chain threat discipline — pin and lock, audit for advisories, vet a new dependency before adding it, and treat install scripts and typosquats as attack surface. Invoke before adding or upgrading a dependency, or when hardening a project's build against a compromised package. Complements the security-review skill, which covers your own code's threat model.
Often used withattack-chainpentest-toolsbinary-diff
MANVENDRA-githubCursor ruleMANVENDRA-github/agentry/.cursor/rules/sql/injection-safety.mdc
SQL injection-safety discipline — every user value goes through a bound parameter, never string-built SQL, allowlist the identifiers that can't be bound. Apply when writing or reviewing any SQL or query-building code. Skip only for a fixed, fully-static query with no external input anywhere in it.
KangaKodeCursor ruleKangaKode/universal-agent-bootstrap/.cursor/rules/minimalist.mdc
Prevents over-engineering and code bloat. Invoke on any change over 100 lines or when reviewing for unnecessary complexity.
pavlelausevicCursor rulepavlelausevic/business-reasoning/.cursor/rules/business-reasoning.mdc
Diagnostic business judgment from twelve canonical business books. Use for any question about validating, pricing, positioning, marketing, monetizing or scaling a business, product or side project — including casual phrasings, and even inside a coding task. Also covers competitor research from real reviews and Google Play launches.
MANVENDRA-githubReads credentialsCursor ruleMANVENDRA-github/agentry/.cursor/rules/secrets-management.mdc
Handle a secret across its whole lifecycle — keep it out of source and image layers, inject it at runtime via environment or a secret store, scope each credential to least privilege, and rotate on a schedule and immediately after exposure. Invoke when code needs an API key, DB password, token, or private key, or when wiring how an app obtains its secrets. Complements the secret-scan hook (which only blocks committing a literal) and security-review (which only flags secrets in your diff). Skip for code that handles no credentials.
andr-caCursor ruleandr-ca/agentharness/.cursor/rules/api-design.mdc
Use when designing, reviewing, or evolving a REST or GraphQL API — resource naming, HTTP status codes, versioning strategy, error response shapes, pagination, and authentication patterns.
tounsilsCursor ruletounsils/claude-code-skills/.cursor/rules/audit-security.mdc
Security review of a change or working tree against the OWASP Top 10: committed secrets, injection, broken access control, SSRF, insecure deserialization, permissive CORS, vulnerable dependencies, and sensitive data in logs. Reports exploitability, not category names. Use when asked to security review this, audit for vulnerabilities, check this is safe to ship, or before pushing code that touches auth, user input, or data access.
abxn4rCursor ruleabxn4r/archon-skills/.cursor/rules/dijkstra.mdc
ALWAYS invoke when the user mentions Dijkstra (e.g., 'Dijkstra', 'ask Dijkstra', 'run Dijkstra', 'consult Dijkstra') or asks for engineering architecture review. Engineering Architect & Principal Engineer evaluating system architecture, codebase health, PRs, technical debt, scalability, refactoring, code quality, and engineering decisions across thousands of commits.
danielvm-gitReads credentialsCursor ruledanielvm-git/bigpowers/.cursor/rules/security-review.mdc
AI-powered security analysis of code changes — traces data flow, detects injection, auth bypass, secrets exposure, and unsafe deserialization across files. Use when reviewing pending changes, before release-branch, during verify-work Phase 5, during build-epic Step 0 threat modeling, or when the user says \"security review\" or \"scan for vulns\".
Fadi88Cursor ruleFadi88/one-man-startup/.cursor/rules/agent-security.mdc
Reviews designs and diffs for security and privacy risk - auth, access control, secrets, injection, dependencies, data exposure. It writes its report and never changes code. Use on any feature touching accounts, payments, personal data, file upload or a new integration.
galyarderlabsReads credentialsCursor rulegalyarderlabs/galyarder-framework/.cursor/rules/security-guardian.mdc
Security vulnerability detection and remediation specialist. Audits code for OWASP Top 10, IDOR, SSRF, and injection. Enforces zero trust and secure data handling for financial and AI platforms. Contains full knowledge of security reviewer and audit checklists.
mchittineniCursor rulemchittineni/cloud-platform-skills/.cursor/rules/skills/ai-agent-security-llm-threats.mdc
Security for LLM and agent systems: direct and indirect prompt injection, the OWASP Top 10 for LLM Applications, MITRE ATLAS technique mapping, excessive agency and tool-scope containment, egress allowlisting to stop data exfiltration, human confirmation for irreversible actions, and treating third-party skills and MCP servers as untrusted code. Use when an agent is given tools or credentials, when retrieved documents or repository files could carry injected instructions, or when reviewing an AI feature before it reaches production.
danielvm-gitCursor ruledanielvm-git/bigpowers/.cursor/rules/commit-message.mdc
Reviews working-tree changes, then drafts a Conventional Commits title/body and states the semantic-release version bump a single such commit would imply. Also notes which defensive-code categories were touched. Use when the user wants to commit recent work, prepare a Conventional Commits message, or asks for semantic-release / semver-consistent messaging before git commit.
anmolnagpalCursor ruleanmolnagpal/devops-skills/.cursor/rules/owasp.mdc
Security review requiring judgment about exploitability: injection and input handling, authentication and session management, authorization, secret storage and cryptography, and Agentic AI risks, against OWASP Top 10:2025 and ASVS 5.0. Use when user says 'review for security', 'is this secure', 'review this endpoint for injection', 'check for SQL injection or XSS', 'review auth/authorization', 'how are we storing secrets', 'check how we store secrets in this service', 'is this crypto correct', or when writing cryptography, session management, or AI agent code. Judges reachability and impact in this codebase; /clouddrove:appsec owns the deterministic checks a tool can answer (lockfile CVEs, missing headers, wildcard CORS).
andr-caCursor ruleandr-ca/agentharness/.cursor/rules/requirements-clarification.mdc
Use before implementing a significant feature or change when requirements are ambiguous, underspecified, or likely to have multiple reasonable interpretations, or when a requirement arrives pre-formed as an issue, audit finding, or review comment whose claim needs checking — covers verifying the premise before acting, structured discovery, one question at a time, edge-case probing, and writing a brief requirements summary before coding starts.
RagnarPitlaCursor ruleRagnarPitla/microsoft-agent-skills-private-archive/.cursor/rules/migrate-agent-to-skills.mdc
Move an existing agent - a prompt-stuffed assistant, a legacy chatbot, a pile of custom instructions, a hand-rolled Python agent - onto a portable skills-based harness without carrying its rot forward. Use when a system prompt has grown past what anyone can review, when someone wants to break a monolithic agent into skills, when moving off Power Virtual Agents or a bespoke framework, when the same behaviour has to run in GitHub Copilot, Claude Code, Cursor and Codex, or when a migration has produced skill files that nothing ever reaches for.
andr-caCursor ruleandr-ca/agentharness/.cursor/rules/port-agent-config.mdc
Use when asked to port, migrate, or add equivalent agent instructions, skills, or custom sub-agents for a different coding tool than the one already configured — e.g. \"add Cursor support from our CLAUDE.md\", \"we're switching from Cursor to Codex, port our rules\", \"make this work for Copilot too\", \"port our review subagent to Codex\". Covers both agentharness-linked projects (use the real generators, don't hand-write) and plain projects with hand-authored config (port by hand, same principles).
Instruction files for Cursor's agent, kept in .cursor/rules/ as .mdc files.
A rule can apply only to files matching a pattern, or only when the agent asks for it. AGENTS.md always applies.
Copy the .mdc file into your project's .cursor/rules/ directory and adjust its globs.
Open a rule to see its discussion. Reports from people and their agents are coming.
