AGENTS.md examples from real projects

shiahonb777AGENTS.md

web-to-app

shiahonb777/web-to-app/AGENTS.md

# AGENTS.md Instructions for coding agents working in this repository. ## Facing a problem Do not

lancedbAGENTS.md

lance

lancedb/lance/AGENTS.md

more. - Be concise and clear. Focus on P0/P1 issues: severe bugs, performance degradation, security concerns. - Do not reiterate detailed changes or repeat what's already well done. - Check naming consistency

KiranismAGENTS.md

next-shadcn-dashboard-starter / vercel-react-best-practices

Kiranism/next-shadcn-dashboard-starter/.agents/skills/vercel-react-best-practices/AGENTS.md

invoked directly. Next.js documentation explicitly states: "Treat Server Actions with the same security considerations as public-facing API endpoints, and verify if the user is allowed to perform a mutation

No other project uses it yet

qbittorrentAGENTS.md

search-plugins

qbittorrent/search-plugins/AGENTS.md

this order: * Correctness * Logic errors and edge cases * Memory leaks and unsafe memory access * Security vulnerabilities * API misuse * Incorrect error handling * Performance * Coding style * Prefer idiomatic expressions * Check for English

uswdsAGENTS.md

uswds

uswds/uswds/AGENTS.md

gulp cleanDist` clears. - **Project Focus**: US federal (GSA/TTS) open source project. Accessibility, performance, and security are critical. All updates must align with these requirements. ## Common Commands - **Install**: `npm install

shiaho777AGENTS.md

web-to-app

shiaho777/web-to-app/AGENTS.md

# AGENTS.md Instructions for coding agents working in this repository. ## Facing a problem Do not

FULU-FoundationAGENTS.md

OrcaSlicer-bambulab

FULU-Foundation/OrcaSlicer-bambulab/AGENTS.md

NNNN` when applicable, and call out dependency bumps or profile migrations for maintainer review. ## Security & Configuration Tips Follow `SECURITY.md` for vulnerability reporting. Keep API tokens and printer credentials

facebookAGENTS.md

pyre-check

facebook/pyre-check/AGENTS.md

Meta's performant type checker for Python (PEP 484 compliant). It includes **Pysa**, a security-focused static analysis tool for taint analysis. The core engine is written in OCaml (`source

tech-leads-clubAGENTS.md

agent-skills

tech-leads-club/agent-skills/AGENTS.md

format # Skills npm run generate:data # Regenerate skills-registry.json + marketplace data npm run scan # Security scan (snyk-agent-scan, incremental; requires SNYK_TOKEN) nx g @tech-leads-club/skill-plugin:skill {name

detektAGENTS.md

detekt

detekt/detekt/AGENTS.md

code example * * * * // Good code example * */ class MyRule(config: Config) : Rule(config) { // Implementation } ``` ## Security If you discover a security vulnerability, please report it to **security@detekt.dev**. See [SECURITY.md](SECURITY.md) for the full

cosmosAGENTS.md

cosmos-sdk

cosmos/cosmos-sdk/AGENTS.md

reading before introducing a breaking change; add a corresponding entry alongside the changelog note - **Security:** `SECURITY.md` — report security-sensitive findings here, not in a normal PR ## Scope - **IBC** is maintained

LaoFeng-mouseAGENTS.md

flyingmouse-format

LaoFeng-mouse/flyingmouse-format/AGENTS.md

不能静默丢弃无法表示的绘图或事件。 - 音频源不得暴露 MP4/WebM/MKV/MOV 等视频容器目标。 - 仅支持普通音乐格式转换，不支持其他音乐平台的加密特殊格式。公开源码、构建白名单、CLI、HTTP 和 UI 必须保持相同边界，不能以运行时开关隐藏平台专用代码后公开。 ## Security boundaries - Electron 必须保持 `contextIsolation: true`、`nodeIntegration: false`、`sandbox: true`。 - 渲染器导航和 IPC sender 必须匹配本次启动的精确 `127.0.0.1` origin

bkremAGENTS.md

awesome-solidity

bkrem/awesome-solidity/AGENTS.md

sync with the TOC at the top of the file): - `Resources` — Official, Tutorials, Articles, Security (+ Audits), Examples (Educational, Deployed on Ethereum Mainnet), Templates, Books, Practice, Jobs - `Libraries` - `Tools` — General, Utility

kvcache-aiAGENTS.md

Mooncake / mooncake-store

kvcache-ai/Mooncake/mooncake-store/AGENTS.md

helpers. - Do not migrate `src/cachelib_memory_allocator/` unless explicitly requested. - The shared engine is not cryptographically secure; do not use it for secrets or authentication tokens. ## Local-first Host Identity - Keep

No other project uses it yet

midudevAGENTS.md

autoskills

midudev/autoskills/AGENTS.md

AGENTS ## Supply Chain Security This project has been hardened against supply chain attacks using [fendo](https://github.com/midudev/fendo). ### Rules for AI assistants and contributors - **Never use `^` or `~`** in dependency version

firebaseAGENTS.md

firebase-ios-sdk

firebase/firebase-ios-sdk/agents.md

valid `GoogleService-Info.plist` files. * In the CI (Continuous Integration) environment, these files are usually provided securely (e.g., via environment variables, mounted secrets, or dedicated build steps that place the correct plist

luckjiaweiAGENTS.md

frpc-desktop

luckjiawei/frpc-desktop/AGENTS.md

broad formatting churn, or dependency upgrades as part of a focused fix. ## Data and Security - Treat configuration, tokens, proxy definitions, logs, and local paths as sensitive. Do not log secrets

Anil-matchaAGENTS.md

open-dots / mobile

Anil-matcha/open-dots/mobile/AGENTS.md

time is injected), `lib/hosted-credentials.ts` keeps the account session and the install id in the secure store apart from the workspace token (`lib/credentials.ts` marks it `hosted`), `components/hosted-gate.tsx` shows the app only

No other project uses it yet

fullstackheroAGENTS.md

dotnet-starter-kit

fullstackhero/dotnet-starter-kit/AGENTS.md

recurring jobs | `jobs.md` | | Outbound HTTP resilience (Polly) | `resilience.md` | | Files/blobs, presigned uploads, providers | `storage.md` | | CORS, security headers, rate limiting, idempotency, quotas, front-end link origins | `security.md` | | SignalR / SSE backend | `realtime.md` | | Logging

uditgoenkaAGENTS.md

autoresearch

uditgoenka/autoresearch/AGENTS.md

investigation | | `autoresearch:fix` | Autonomous error repair — one fix per iteration until zero errors | | `autoresearch:security` | STRIDE + OWASP + red-team security audit (read-only unless `--fix`) | | `autoresearch:ship` | Universal shipping workflow

No other project uses it yet