The rules real projects give Cursor's agent, from .cursor/rules.
raye-dengCursor ruleraye-deng/open-code-review/.cursor/rules/open-code-review.mdc
Open Code Review - AI code quality gate for detecting hallucinated packages, stale APIs, context breaks, security anti-patterns, and over-engineering in AI-generated code.
RatimonCursor ruleRatimon/openquok-monorepo/.cursor/rules/security-guidelines.mdc
Security — no service client in client code, no SUPABASE_SECRET_KEY on client, RLS, correct Supabase client per context, rate limit config, SSR state rules (no authenticationRepository in server load, ssr = false for protected routes)
KangaKodeCursor ruleKangaKode/universal-agent-bootstrap/.cursor/rules/code-reviewer.mdc
Code review quality gate — enforces architecture, code quality, and security conventions. Use proactively after any code change.
KangaKodeCursor ruleKangaKode/universal-agent-bootstrap/.cursor/rules/red-team.mdc
Adversarial security gate — blocks commits with secrets, injection vulnerabilities, SSRF, and authorization failures. Run before every commit.
afaraha8403Cursor ruleafaraha8403/balakit/.cursor/rules/seo-ai-search.mdc
Universal guidelines for SEO and AI-search implementation — meta tags, JSON-LD, llms.txt, crawlability, and adversarial security.
galyarderlabsCursor rulegalyarderlabs/galyarder-framework/.cursor/rules/security-reviewer.mdc
Security vulnerability detection and remediation specialist. Use PROACTIVELY after writing code that handles user input, authentication, API endpoints, or sensitive data. Flags secrets, SSRF, injection, unsafe crypto, and OWASP Top 10 vulnerabilities.
Surya8991Cursor ruleSurya8991/AgentMaster/.cursor/rules/codereview.mdc
Blunt, factual code review. No sugar coating. Finds bugs, security issues, performance problems, and architecture flaws. Use when user says /codereview or asks to review code.
anmolnagpalCursor ruleanmolnagpal/devops-skills/.cursor/rules/github-actions.mdc
GitHub Actions workflow review, scaffolding, and security hardening. Use when user says 'review my workflow', 'check my actions', 'scaffold a workflow', 'is my CI correct', 'pin actions', 'OIDC to AWS', or when working in .github/workflows/*.yml files.
codegobrrrr9Cursor rulecodegobrrrr9/seatbelt/.cursor/rules/seatbelt.mdc
seatbelt — pre-ship safety rules. Stops secrets in client code or git, tables without row security, routes without auth, open CORS, unverified webhooks.
galyarderlabsCursor rulegalyarderlabs/galyarder-framework/.cursor/rules/audit-website.mdc
Audit websites for SEO, performance, security, technical, content, and 15 other issue cateories with 230+ rules using the squirrelscan CLI. Returns LLM-optimized reports with health scores, broken links, meta tag analysis, and actionable recommendations. Use to discover and asses website or webapp issues and health.
MANVENDRA-githubCursor ruleMANVENDRA-github/agentry/.cursor/rules/code-review.mdc
Self-review discipline for in-conversation use — apply before declaring code complete or before committing. Walks correctness, security, maintainability, and convention checks at the time of writing. For focused review of a large diff in a fresh context, delegate to the code-reviewer agent.
mchittineniCursor rulemchittineni/cloud-platform-skills/.cursor/rules/skills/secops-incident-triage-forensics.mdc
Security incident response: compromise triage, cloud instance and credential containment, forensic disk and memory capture with chain of custody, IAM session and key revocation, and SIEM correlation for threat hunting. Use when a host, container or cloud credential is suspected compromised, when a leaked access key found in a public repository has already been used, or when capturing evidence.
edhoferdianCursor ruleedhoferdian/EEF/.cursor/rules/skill-authoring-edho-ferdian.mdc
Discipline for creating and governing this ecosystem's own skills: search before building (local → marketplace → GitHub → web, with a security vet on anything external), write to a quality bar, measure whether a skill is actually obeyed rather than assuming it, promote recurring cross-skill principles up into rules, and package a finished skill into `dist/*.skill` for manual upload. Use when the user says \"bikin skill baru\", \"ada skill buat X gak\", \"fork skill ini\", \"skill gue kepake gak sih\", \"package skill ini\", \"mau publish skill ini\", \"buatkan .skill-nya\", or before adding anything to this repo's `skills/` or `dist/`.
mchittineniCursor rulemchittineni/cloud-platform-skills/.cursor/rules/skills/cicd-pipeline-design.mdc
CI/CD pipeline architecture for GitHub Actions and GitLab CI: matrix testing, dependency caching, OIDC keyless cloud authentication, security gating, and concurrency control. Use when a pipeline is slow because every job reinstalls dependencies, when long-lived AWS or cloud access keys stored as CI secrets must be removed, or when building, gating and speeding up a build-test-deploy workflow.
mchittineniCursor rulemchittineni/cloud-platform-skills/.cursor/rules/skills/shift-left-security-sast-sca.mdc
Shift-left security automation: Semgrep SAST, Trivy and Snyk dependency and image scanning, Gitleaks repository scans for committed credentials, and SBOM generation in CycloneDX or SPDX format. Use when adding code, dependency or image scanning to a CI pipeline, when a scanner reports hundreds of findings that developers now ignore and gates need tuning for false positives, or when a customer or auditor asks for an SBOM produced by the build.
mchittineniCursor rulemchittineni/cloud-platform-skills/.cursor/rules/skills/supply-chain-security-slsa-sigstore.mdc
Software supply chain security: keyless Sigstore/cosign signing with OIDC, SLSA build levels, in-toto provenance attestations, SBOM attestation, and signature plus identity verification enforced at Kubernetes admission with Kyverno or the sigstore policy-controller. Use when release artifacts or container images need signing, provenance or attestation, when a customer or auditor asks which SLSA level a build meets, or when only trusted and verified images should be allowed to run in a cluster.
mchittineniCursor rulemchittineni/cloud-platform-skills/.cursor/rules/skills/policy-as-code-opa-kyverno.mdc
Policy as code for Kubernetes and infrastructure: authoring Kyverno ClusterPolicy rules, OPA Rego in a Gatekeeper ConstraintTemplate, and Conftest checks, plus Pod Security Standards enforcement, policy unit testing, and an owned exception register with expiry dates. Use when privileged containers or pods without resource limits must be rejected at admission rather than reported, when admission policies need tests so a rule cannot silently stop matching, or when choosing between Kyverno and OPA Gatekeeper.
edhoferdianCursor ruleedhoferdian/EEF/.cursor/rules/language-code-review-edho-ferdian.mdc
Language- and framework-specific code review lenses layered on top of the general four-domain review in code-review-edho-ferdian — idioms, framework security misconfigurations, ORM/query correctness, performance traps, and testing conventions, auto-detected across ~20 stacks (React, Python, Go, Java/Spring, Ruby, and more — see the reference table below for the full list). Use whenever a review touches a specific language/framework and the generic checklist isn't enough — \"review kode Go/Python/React ini\", \"audit Django models\", \"cek FastAPI endpoint ini\", or when the user names a stack while asking for review. Loads only the lens file(s) matching the detected stack. Inherits Reflection and Critique-Correction gates from code-review-edho-ferdian.
Surya8991Cursor ruleSurya8991/AgentMaster/.cursor/rules/repomix-pack.mdc
Packs the entire codebase (or selected folders) into a single token-efficient file using repomix, so other skills can analyze the whole repo without re-reading individual files. Use when the task requires whole-codebase context: full security audits, cross-cutting refactors, architecture review, project-wide code review, or first-time onboarding to an unfamiliar repo. Auto-runs once per session at first invocation of agent-master.
mchittineniCursor rulemchittineni/cloud-platform-skills/.cursor/rules/skills/detection-engineering-threat-hunting.mdc
Detection engineering and threat hunting: detection-as-code with Sigma rules in version control, log pipeline and telemetry source coverage, MITRE ATT&CK coverage mapping, alert precision and tuning to survive analyst trust, validation with Atomic Red Team, and hypothesis-driven hunts for activity that evaded automated controls. Use when security alerts are too noisy to act on, when deciding which detections to write and which telemetry to collect first, or when hunting for attacker activity nothing has alerted on.
Instruction files for Cursor's agent, kept in .cursor/rules/ as .mdc files.
A rule can apply only to files matching a pattern, or only when the agent asks for it. AGENTS.md always applies.
Copy the .mdc file into your project's .cursor/rules/ directory and adjust its globs.
Open a rule to see its discussion. Reports from people and their agents are coming.
