AGENTS.md examples from real projects

sandboxie-plusAGENTS.md

Sandboxie

sandboxie-plus/Sandboxie/AGENTS.md

change guidelines - Treat `Sandboxie/core` with extreme caution: bugs can cause BSODs or sandbox-escape security holes. Prefer minimal, surgical patches there over refactors. - Verify builds, branches, and properties

No other project uses it yet

elizaOSAGENTS.md

eliza

elizaOS/eliza/AGENTS.md

desktop/mobile inspection. - Submit changes through a PR against `develop`. Report vulnerabilities privately through GitHub Security Advisories. The community plugin registry is retired; first-party catalog data lives in `packages/core/src/catalog/`. Getting

No other project uses it yet

agent0aiAGENTS.md

agent-zero / agents

agent0ai/agent-zero/agents/AGENTS.md

metadata and inherited prompt specifics. | | [developer/AGENTS.md](developer/AGENTS.md) | Software development specialist profile. | | [hacker/AGENTS.md](hacker/AGENTS.md) | Cyber security and penetration testing specialist profile. | | [researcher/AGENTS.md](researcher/AGENTS.md) | Research, data analysis, and reporting specialist profile. | | [tiny

No other project uses it yet

agent0aiReads credentialsAGENTS.md

agent-zero

agent0ai/agent-zero/AGENTS.md

variables before plugin setup. - LiteLLM and OpenAI pins must remain compatible. Retain shared dependency security floors and verify upgrades with installed-SDK HTTP tests in `tests/test_litellm_sdk.py` using the framework runtime

No other project uses it yet

agent0aiAGENTS.md

agent-zero / api

agent0ai/agent-zero/api/AGENTS.md

changing handler behavior. - For auth, CSRF, upload/download, tunnel, or file endpoints, run the nearest security regression tests. - Check file-level documentation coverage with a script or shell loop that verifies

No other project uses it yet

agent0aiAGENTS.md

agent-zero / extensions

agent0ai/agent-zero/extensions/AGENTS.md

repeatedly when the lifecycle point can fire multiple times. - Secret masking, auth, security, and persistence extensions must not be bypassed by convenience changes. ## Work Guidance - Keep extension code small

No other project uses it yet

agent0aiAGENTS.md

agent-zero / helpers

agent0ai/agent-zero/helpers/AGENTS.md

belong in `api/`, tool behavior in `tools/`, and plugin-local logic inside plugin directories. - Security, auth, settings, file access, plugin discovery, extension dispatch, notifications, state snapshots, scheduler, tunnel, and WebSocket

No other project uses it yet

agent0aiAGENTS.md

agent-zero / plugins

agent0ai/agent-zero/plugins/AGENTS.md

update flows from ZIP, Git, and Plugin Index. | | [_plugin_scan/AGENTS.md](_plugin_scan/AGENTS.md) | LLM-guided security scanner for third-party plugins. | | [_plugin_validator/AGENTS.md](_plugin_validator/AGENTS.md) | Plugin manifest, structure, convention, and security

No other project uses it yet

agent0aiAGENTS.md

agent-zero / references

agent0ai/agent-zero/skills/a0-create-plugin/references/AGENTS.md

handlers. - Keep local-only work separate from community publication and catalog discovery separate from security scanning. - Preserve authentication, scope, user authorization, and unrelated runtime state. ## Work Guidance - Prefer existing framework

No other project uses it yet

agent0aiAGENTS.md

agent-zero / a0-manage-plugin

agent0ai/agent-zero/skills/a0-manage-plugin/AGENTS.md

behavior, scan expectations, and activation semantics current. - Distinguish Index discovery from model-based security scans and installation; metadata is not verified capability or safety. - Handle missing/null Index fields and check

No other project uses it yet

agent0aiAGENTS.md

agent-zero / references

agent0ai/agent-zero/skills/a0-manage-plugin/references/AGENTS.md

handlers. - Keep local-only work separate from community publication and catalog discovery separate from security scanning. - Preserve authentication, scope, user authorization, and unrelated runtime state. ## Work Guidance - Prefer existing framework

No other project uses it yet

agent0aiAGENTS.md

agent-zero / tests

agent0ai/agent-zero/tests/AGENTS.md

Tests DOX ## Purpose - Own pytest regression, security, integration, and contract tests. - Keep tests focused on behavior that should remain stable across framework changes. ## Ownership - Test files live directly under `tests

No other project uses it yet

compiler-explorerReads credentialsAGENTS.md

compiler-explorer

compiler-explorer/compiler-explorer/AGENTS.md

hooks (`npm run check-frontend-imports`) - Violations will cause build failures and prevent commits ## Security Review Calibration - Internal, CE-controlled endpoints (e.g. the conan library server) are not hostile: treat

No other project uses it yet

eggjsDeletes or force-pushesAGENTS.md

egg

eggjs/egg/AGENTS.md

loader): ensure middleware order` - keep PR descriptions clear about motivation, scope, and test evidence ## Security And Config - review `SECURITY.md` before handling vulnerability-related work - do not commit secrets, credentials

wledDeletes or force-pushesAGENTS.md

WLED

wled/WLED/AGENTS.md

description - in addition to comments markers in the source code (see Comments section). ### Security Hardening When writing or reviewing code in `wled00/`, `usermods/`, `wled00/data/`, or `.github/workflows/`, consult `docs/hardening.instructions.md` (concise checklist

facebookAGENTS.md

yoga

facebook/yoga/AGENTS.md

just that platform. Choose the appropriate type: `[Breaking]`, `[Added]`, `[Changed]`, `[Deprecated]`, `[Removed]`, `[Fixed]`, or `[Security]`. If the change truly has no user-visible effect, such as a test-only

browser-useAGENTS.md

browser-harness

browser-use/browser-harness/AGENTS.md

routine PR gates. - First-time install / blocked Chrome: follow `install.md` (`chrome://inspect/#remote-debugging`). # Security - Do not commit secrets, Browser Use Cloud tokens, or session cookies. - Prefer the smallest change

No other project uses it yet

langbot-appReads credentialsAGENTS.md

LangBot

langbot-app/LangBot/AGENTS.md

suite session_summary` passing. - Code comments and docstrings must be English. - Keep compatibility and security in mind; LangBot is used in both self-hosted/community and toB deployments. - Commit message

uikitAGENTS.md

uikit

uikit/uikit/AGENTS.md

latest versioned release. Add entries under non-empty `### Added`, `### Changed`, `### Deprecated`, `### Removed`, `### Fixed`, or `### Security` categories. - Never commit generated `dist` files. - Do not modify SCSS files; they are generated from

No other project uses it yet

arc53Reads credentialsAGENTS.md

DocsGPT

arc53/DocsGPT/AGENTS.md

bash vale . ``` ## Repository map - `docsgpt/`: Flask backend, API routes, agent logic, retrieval, parsing, security, storage, Celery worker, and WSGI entrypoints. - `tests/`: backend unit/integration tests and test-only Python dependencies. - `frontend