How real projects brief Codex, Cursor and every other agent that reads AGENTS.md.
code-yeongyuAGENTS.mdcode-yeongyu/oh-my-openagent/.agents/AGENTS.md
form of the `/publish` command | | `remove-deadcode/` | NEW | Skill form of the `/remove-deadcode` command | | `security-research/` | NEW | Team Mode security research audit: 3 vulnerability hunters + 2 PoC engineers | | `codex
code-yeongyuAGENTS.mdcode-yeongyu/oh-my-openagent/AGENTS.md
when sidebar is disabled ├─→ initLiveServerRoute() + setLiveParentWakeRoutingDisabled() + warmLiveServerProbe() # live-listener wake routing ├─→ selectRuntimeSecuritySkills() + createRuntimeSkillSourceServer() # runtime security-skill source ├─→ initI18n() # load locale strings (packages/omo-opencode/src/locales/) ├─→ setAgentSortOrder() # apply configured agent_order ├─→ initializeOpenClaw() # if openclaw
code-yeongyuAGENTS.mdcode-yeongyu/oh-my-openagent/.opencode/AGENTS.md
Remove unused code with LSP-verified safety + atomic commits. | | `/security-research` | Run the Team Mode security-research audit with 3 vulnerability hunters and 2 PoC engineers. | ## OTHER CONTENTS - `background-tasks.json` — Runtime state
code-yeongyuAGENTS.mdcode-yeongyu/oh-my-openagent/tests/AGENTS.md
equality between real artifacts, and observable runtime behavior such as parsing, routing, dispatch, state, security, and dynamic input propagation. - Treat `tests/hashline/` as its own Bun package. Preserve its lockfile
mem0aiAGENTS.mdmem0ai/mem0/AGENTS.md
bend. ### Reference | Topic | File | |-------|------| | Contributor guide | [`CONTRIBUTING.md`](CONTRIBUTING.md) | | Code of conduct | [`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md) | | Security reports | [`SECURITY.md`](SECURITY.md) | | Development setup | `docs/contributing/development.mdx` | | Documentation contributions | `docs/contributing/documentation.mdx` | | PR template | `.github/PULL_REQUEST_TEMPLATE.md` | | Issue forms | `.github/ISSUE_TEMPLATE/` | | Contribution
gsd-buildAGENTS.mdgsd-build/get-shit-done/docs/AGENTS.md
checker, integration-checker, ui-checker | | Verifiers | 1 | verifier | | Auditors | 3 | nyquist-auditor, ui-auditor, security-auditor | | Mappers | 1 | codebase-mapper | | Debuggers | 1 | debugger | | Doc Writers | 2 | doc-writer, doc-verifier
mvanhornAGENTS.mdmvanhorn/last30days-skill/AGENTS.md
versions stay lockstep: 1. **Feature/fix PRs:** add `changelog.d/ . .md` (`added` / `changed` / `fixed` / `removed` / `deprecated` / `security`) when the change belongs in the next release notes. See `changelog.d/README.md` and `CONTRIBUTING.md`. Fill
calesthioAGENTS.mdcalesthio/OpenMontage/.agents/skills/vercel-react-best-practices/AGENTS.md
invoked directly. Next.js documentation explicitly states: "Treat Server Actions with the same security considerations as public-facing API endpoints, and verify if the user is allowed to perform a mutation
aaif-gooseAGENTS.mdaaif-goose/goose/AGENTS.md
Feature). `gh issue create` does not apply templates automatically. Maintainer-directed work, urgent security fixes, release automation, and local or exploratory changes do not require a Ready issue. ## MCP Server
CherryHQAGENTS.mdCherryHQ/cherry-studio/.agents/skills/vercel-react-best-practices/AGENTS.md
invoked directly. Next.js documentation explicitly states: "Treat Server Actions with the same security considerations as public-facing API endpoints, and verify if the user is allowed to perform a mutation
AstralAGENTS.mdastral-sh/ruff/AGENTS.md
issue, do not submit a competing one without maintainer agreement. ## Code Review Rules For security reviews of Ruff and ty runtime changes, use the [threat models](agents/references/threat-models.md) to assess trust
QuantumNousAGENTS.mdQuantumNous/new-api/AGENTS.md
domain concept rather than a mechanical step extracted only to shorten the caller. ### Authentication Security (OWASP Mandatory) - Any implementation, modification, or review involving authentication-related flows MUST comply with
HKUDSAGENTS.mdHKUDS/nanobot/AGENTS.md
nanobot/skills/`): Built-in skill definitions (cron, github, image-generation, etc.) loaded into agent context. - **Security** (`nanobot/security/`): PTH file guard and other security measures activated at CLI entry. ### Entry Points
jeecgbootAGENTS.mdjeecgboot/JeecgBoot/jeecgboot-vue3/AGENTS.md
src/utils/http/axios/` wraps Axios with: - Token injection through interceptors. - MD5 request signing for API security. - Multi-tenant header support. - Standard response unwrapping through the `result` field. API functions usually follow this
sickn33AGENTS.mdsickn33/agentic-awesome-skills/AGENTS.md
validation. - `npm run validate`: validate skill frontmatter, required sections, and schema rules. - `npm run security:docs`: run safety checks for command, install, credential, and network guidance. - `npm run test
SentryAGENTS.mdgetsentry/sentry/src/AGENTS.md
critical commands, see the "Command Execution Guide" section in `/AGENTS.md` in the repository root. ## Security Guidelines ### Preventing Indirect Object References (IDOR) Multi-tenant queries MUST be scoped — never trust user
K-Dense-AIAGENTS.mdK-Dense-AI/scientific-agent-skills/AGENTS.md
tools` a space-separated string, `metadata` scalars quoted, and a warning past 500 lines. Security-scan new or substantially changed skills. Scanning uses [Cisco AI Defense Skill Scanner](https://github.com
amruthpillaiAGENTS.mdamruthpillai/reactive-resume/AGENTS.md
full|wenyan-ultra Stop: "stop caveman" or "normal mode" Auto-Clarity: drop caveman for security warnings, irreversible actions, user confused. Resume after. Boundaries: code/commits/PRs written normal. ## Agent skills - Issues
LangChainAGENTS.mdlangchain-ai/langgraph/AGENTS.md
This repository is a monorepo. Each library lives in a subdirectory under `libs/`. ## Corridor security analysis When Corridor's `analyzePlan` tool is available, create a plan and use the tool
git-df-scottAGENTS.mdgit-df-scott/claude-skills/get-shit-done/AGENTS.md
relevant, test evidence, affected platforms/runtimes, and update `CHANGELOG.md` or docs for user-facing changes. ## Security & Configuration Tips Do not commit secrets, local config, or generated worktree artifacts. Before release-facing
An open format for instructions to coding agents, read by Codex, Cursor and others. Think of it as a README written for agents.
At the repository root, with more specific files in subdirectories. Agents read the one closest to the file they're editing.
Setup and test commands, code style, and the rules a new contributor would need to know.
Claude Code reads CLAUDE.md. A one-line CLAUDE.md that points at AGENTS.md covers both.
