Researched for Cursor real features. Replace the [BRACKETED] parts with your own details, copy, and paste.
1Composer multi-file feature build
You are a senior [FRAMEWORK] engineer. Use Cursor Composer to implement this feature across the codebase: [FEATURE_DESCRIPTION]. Reference @Files for [ENTRY_FILES], use @Codebase to find where [RELATED_LOGIC] lives, and @Docs for the [LIBRARY_DOCS] version pinned in package.json. Deliverable: working code in all affected files, a short summary of what changed per file, and a checklist of manual tests to run. Constraints: no new dependencies without asking, match the existing code style in [STYLE_REFERENCE_FILE], keep each function under 40 lines, and do not change public API signatures unless listed in [ALLOWED_API_CHANGES].
2Bugbot-style code review prompt
Act as Bugbot, a strict code reviewer for this repository. Review @Files [FILE_LIST] line by line for: bugs, race conditions, null-safety gaps, insecure input handling, and performance hotspots in [LANGUAGE]. For each issue, output severity (Critical, Major, Minor), the exact file and line, a one-sentence explanation of why it is wrong, and a corrected code snippet that compiles against the current codebase context from @Codebase. Also list anything that is correct but could be simplified. Constraints: do not invent functions or APIs that are not visible in @Codebase; flag anything you cannot verify as Needs human review.
3Custom Rules generator for a project
You are configuring Cursor Rules for a [LANGUAGE] project using [FRAMEWORK_OR_STACK]. Analyze @Codebase and write a .cursorrules file (or .cursor/rules/ directory if one exists) that teaches the AI this project's conventions: import style, component patterns in [COMPONENT_DIR], testing conventions in [TEST_DIR], naming rules, error handling approach, and anything the AI must never do (e.g. [NEVER_DO_ITEMS]). Output the complete rules file content ready to paste, plus a 5-line explanation of why each major rule matters. Constraints: keep rules under 60 lines, use plain language, and only include rules you can support with evidence from @Codebase.
4Codebase onboarding Q&A for new developers
You are an onboarding assistant for this codebase. I am a new [ROLE] joining the team. Using @Codebase, answer these questions in order: 1) What does [PROJECT_NAME] do and who uses it? 2) Where does the main entry point live and what is the startup flow? 3) How is data modeled (key files in [MODEL_DIR])? 4) How do requests flow through [LAYER_DESCRIPTION]? 5) Where are tests, and how do I run them ([TEST_COMMAND])? 6) What are the top 5 gotchas a new dev must know? Keep each answer under 120 words with file links. Constraints: cite only real files found in @Codebase; mark anything unclear as Unverified.
5Tab-friendly refactor plan before accepting autocomplete
Plan a refactor of @Files [TARGET_FILE] for this goal: [REFACTOR_GOAL]. First use @Codebase to list every caller of the functions you will touch. Then produce: a step-by-step refactor plan where each step is small enough for Tab autocomplete to complete safely, the exact function signatures before and after, and the test files in @Files [TEST_FILES] to run after each step. Constraints: behavior must stay identical (no logic changes unless listed in [ALLOWED_LOGIC_CHANGES]); keep public exports unchanged; flag any step that risks breaking callers outside the touched files.
6Migration to a new library version with @Docs
Migrate the code in @Files [AFFECTED_FILES] from [LIBRARY_NAME] version [OLD_VERSION] to version [NEW_VERSION]. Use @Docs [LIBRARY_DOCS] to find the official migration guide and changed APIs; use @Codebase to find every usage of the library across the repo, not just the files I listed. For each changed usage, show the old code and the new code with a one-line reason citing the docs. Deliverable: fully migrated files, a migration summary table (API, old usage, new usage, doc link), and a note on any deprecated API with no direct replacement. Constraints: no unrelated refactoring; keep diffs minimal and reviewable.
7Write failing tests first (TDD) for a bug
Act as a test-driven developer. The bug: [BUG_DESCRIPTION] with reproduction steps [REPRO_STEPS]. Using @Codebase, locate the likely faulty module in [SUSPECT_DIR] and the existing test setup in [TEST_DIR]. First write failing tests in @Files [TEST_FILE] that reproduce the bug exactly (they must fail before the fix). Then fix the source in @Files [SOURCE_FILE] with the minimal change that makes the tests pass, without breaking the other tests in [TEST_DIR]. Output: the new tests, the fix diff, and a paragraph explaining the root cause. Constraints: do not change test framework config; keep the fix scoped to the root cause.
8Performance audit and optimization pass
You are a performance engineer. Profile-oriented review of @Files [HOT_FILES] which handle [WORKLOAD_DESCRIPTION] at roughly [SCALE, e.g. 10k requests/min]. Using @Codebase, trace the hot path end to end and identify: algorithmic inefficiencies, N+1 queries, unnecessary allocations, blocking I/O, and cacheable computations. For each finding give: location, measured or estimated cost, a concrete optimized rewrite, and the tradeoff (readability, memory, complexity). Constraints: preserve external behavior; keep the public interface stable per [INTERFACE_FILE]; rank findings by expected impact and tackle the top 3 in Composer edits.
9Generate typed API client from backend
Generate a typed API client for the backend defined in @Files [BACKEND_ROUTES_OR_SCHEMA]. Target language: [CLIENT_LANGUAGE] ([FETCH_LIB_OR_FRAMEWORK]). The client must include: typed functions for every endpoint, request/response types derived from the actual schemas (use @Codebase to verify field names and types, never guess), error handling that maps backend error codes in [ERROR_FILE] to typed errors, and auth header injection using [AUTH_MECHANISM]. Output the complete client files plus a short usage example per endpoint group. Constraints: 100 percent type coverage, no any types, and a compile check must pass.
10Security hardening review with @Web
Act as an application security reviewer. Audit @Files [SECURITY_SENSITIVE_FILES] for a [APP_TYPE] built with [STACK]. Check: authentication and session handling, authorization checks on every sensitive route, input validation and output encoding, secrets management (no hardcoded keys), dependency risks, and CORS/CSRF configuration. Where the correct modern practice is unclear, use @Web to check the current [YEAR] guidance for [STACK]. Output a findings table (severity, location, issue, fix, reference link) plus the actual patched code for Critical and High items. Constraints: fixes must fit the existing architecture; note anything requiring a dependency upgrade in [DEPENDENCY_NOTES].