AGENTS.md examples from real projects

thumborAGENTS.md

thumbor

thumbor/thumbor/AGENTS.md

thumbor.key` file with real secrets; the repo-root `thumbor.key` is for development only. ## Security considerations - **`SECURITY_KEY`** defaults to `"MY_SECURE_KEY"`. Always override this in production. - **`ALLOW_UNSAFE

No other project uses it yet

polarsourceAGENTS.md

polar / vercel-react-best-practices

polarsource/polar/.agents/skills/vercel-react-best-practices/AGENTS.md

invoked directly. Next.js documentation explicitly states: "Treat Server Actions with the same security considerations as public-facing API endpoints, and verify if the user is allowed to perform a mutation

No other project uses it yet

RunanywhereAIAGENTS.md

runanywhere-sdks

RunanywhereAI/runanywhere-sdks/AGENTS.md

hard to detect — a final design decision, an adversarial verification pass, or a security-relevant judgement. ```js // in a Workflow script const findings = await parallel(LENSES.map((l) => () => agent(l.prompt, { label

RunanywhereAIAGENTS.md

runanywhere-sdks / core

RunanywhereAI/runanywhere-sdks/core/AGENTS.md

before calling `rac_init()`: - Mandatory: `file_exists`, `file_read`, `file_write`, `file_delete`, `secure_get/set/delete`, `log`, `now_ms` - Optional, NULL-safe, each null-checked at the call site with

KuberwastakenAGENTS.md

claude-code

Kuberwastaken/claude-code/docs/agents.md

same name. ```json { "agents": { "review": { "description": "Senior code reviewer focused on correctness and security", "model": "anthropic/claude-opus-4-6", "temperature": 0.3, "prompt": "You are a senior software engineer performing code review. Focus

zhu1090093659AGENTS.md

dsh-web-ui

zhu1090093659/dsh-web-ui/docs/AGENTS.md

does / 能力）、安装（Install / 安装）、配置（Config / 配置）、已知限制（Known limitations / 已知限制）。涉及安全的包必须有「安全模型 / Security model」一节。 - **docs/ 只放长期文档**：任务交接、一次性验证记录一律进 docs/archive/，长期文档目录不出现时间戳快照。 - **README 标题层级**：H1 是包名，## 为顶级章节，### 为子节；安装方式的并列选项用

apacheAGENTS.md

cassandra

apache/cassandra/AGENTS.md

suppression comment explaining why. - ⚠️ Ask before modifying the CQL grammar (`src/antlr/Cql.g`) — changes cascade widely. ## Security Security model: [SECURITY.md](./SECURITY.md), which links to the project's security model at [doc/modules/cassandra/pages/reference/security-model.adoc](./doc/modules/cassandra/pages/reference/security-model.adoc

roboflowAGENTS.md

rf-detr

roboflow/rf-detr/AGENTS.md

models or significant features - Wait for approval on approach before implementing 5. **Writing secure, minimal code** - Avoid over-engineering and unnecessary abstractions - Write secure code (prevent injection vulnerabilities) - Follow existing

AWSAGENTS.md

mcp / dynamodb-mcp-server

awslabs/mcp/src/dynamodb-mcp-server/AGENTS.md

variable #### MySQL Analyzer - **Issue**: Connection timeout or permission denied - **Solution**: Verify AWS credentials, check Security Group rules, ensure RDS Data API is enabled - **Debug**: Set `FASTMCP_LOG_LEVEL=DEBUG

No other project uses it yet

HumanizrAGENTS.md

Humanizer

Humanizr/Humanizer/AGENTS.md

without claiming release before publication. Do not add noisy pre-reproduction updates or disclose security-sensitive details. ## Pull Request Guidelines - Keep changes focused with clear commit messages. - Follow repository

open-pencilAGENTS.md

open-pencil

open-pencil/open-pencil/AGENTS.md

packages/*/dist` targets. - `bun run check` — complete build, lint, type, architecture, docs, package, dependency, security, tooling, and duplication gate. - `bun run format` — format and sort imports across the repository; `.oxfmtrc.jsonc

aliasroboticsAGENTS.md

cai

aliasrobotics/cai/docs/agents.md

agent is defined in its own `.py` file in `src/cai/agents` and optimized for specific security domains. ## Available Agents CAI provides a comprehensive suite of specialized agents for different cybersecurity scenarios

wpscanteamAGENTS.md

wpscan

wpscanteam/wpscan/AGENTS.md

agents when working with code in this repository. ## Project Overview WPScan is a WordPress security scanner written in Ruby. It provides WordPress-specific scanning capabilities including vulnerability detection, enumeration

kepanoAGENTS.md

defuddle

kepano/defuddle/AGENTS.md

Defuddle Extracts main content from web pages as clean HTML. ## Security - Never use `innerHTML` directly. Use `parseHTML()` from `src/utils/dom.ts` (template-based parsing without script execution or resource loading). - Escape every

No other project uses it yet

francescopaceAGENTS.md

espectre

francescopace/espectre/AGENTS.md

while associated is a public privacy commitment, stated in `docs/CSI.md` and on the website security page. - Preserve **one message model, multiple transports**: MQTT, Direct HTTP, and future transports carry

francescopaceAGENTS.md

espectre

francescopace/espectre/docs/AGENTS.md

API.md` and `DISCOVERY.md` for shared contracts. - Make public compatibility, controller-support, privacy, and security claims only from repository evidence. Use a validation matrix when coverage is incomplete. ## Topic Owners

francescopaceAGENTS.md

espectre / test

francescopace/espectre/test/AGENTS.md

scans. Text assertions are appropriate only when the value is a documented behavioral, protocol, security, or machine-consumed contract, such as an email address, CLI command, or option value. - Website

No other project uses it yet

spinnakerAGENTS.md

spinnaker

spinnaker/spinnaker/AGENTS.md

Create as drafts (`gh pr create --draft`) - Ensure applicable tests pass locally before pushing ## Security Considerations - Never commit secrets, API keys, or credentials - Be cautious with cloud provider configurations - Review

bluesky-socialAGENTS.md

atproto

bluesky-social/atproto/AGENTS.md

jobs read `devEngines.runtime.version` from `package.json`; tests stay on Node 22 for compatibility, with a security-patched minimum in `.github/workflows/repo.yaml`. Use `node --enable-source-maps` for production-style runs. - TypeScript compilation

doctrineAGENTS.md

dbal

doctrine/dbal/AGENTS.md

marked `lifeSupport` | Target the branch named by the first rule that applies: 1. A security fix or a fix for a new PHP version targets the lowest branch it affects