microsoft/BCQuality is a structured knowledge base and skills library for Microsoft Business Central development. It records Business Central-specific rules and platform behaviors that coding agents or developers might otherwise get wrong. The catalogue entries provide the agents and skill that consume this guidance.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/microsoft/bcquality/set-instructions-as-secrettextgit clone --depth 1 https://github.com/microsoft/BCQualityWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/microsoft/bcquality/set-instructions-as-secrettext)<a href="https://agentmods.dev/agents/microsoft/bcquality/set-instructions-as-secrettext"><img src="https://agentmods.dev/badge/agents/microsoft/bcquality/set-instructions-as-secrettext.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00260 |
| Opus 5 | $0.00000 | $0.00130 |
| Sonnet 5 | $0.00000 | $0.00052 |
| Haiku 4.5 | $0.00000 | $0.00026 |
Grade A, and why
set-instructions-as-secrettext scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Set agent instructions as SecretText on the instance
Description
Instructions are instance data, not an enum caption. Agent.SetInstructions takes SecretText so the payload is not logged or copied as ordinary text. A Label or plaintext Text on the agent type is the wrong store: it leaks into telemetry-friendly strings and cannot vary per instance or company.
Best Practice
Load instruction text from a resource or builder into a SecretText variable and call Agent.SetInstructions(AgentUserSecurityId, Instructions) after Create. Keep one instruction document per instance.
See sample: set-instructions-as-secrettext.good.al.
Anti Pattern
Passing a Label or Text to SetInstructions, storing instructions in a setup Text field without wrapping as SecretText, or putting the prompt only in a code comment. Detection signal: SetInstructions with a non-SecretText argument, or no SetInstructions after Create.
See sample: set-instructions-as-secrettext.bad.al.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 27 lines · 0 tokens per session scan A 7c153a0c4cce
set-instructions-as-secrettext is an agent published in the GitHub repository microsoft/BCQuality (204 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 260 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
tech-debt-auditor
Audits the repo for technical debt, quantifies impact/risk, and produces a prioritized remediation plan with small, safe PR-sized recommendations.
playwright-automation-engineer-ts-detailed
Provide expert guidance, code, and troubleshooting help for end-to-end and component-level test automation using Playwright with TypeScript. Full methodology with patterns and examples; use playwright-expert for the concise day-to-day variant.
skill-librarian
Audits a collection of customization assets as a whole rather than one at a time: frontmatter and structural conformance, description trigger quality, overlap and trigger collisions between near neighbours, broken cross-references, orphaned and missing resources, drift between skills, plugins and the README, and which…
test-automation-expert
Help engineers craft robust, fast, and maintainable automated tests that deliver actionable feedback and integrate seamlessly into modern SDLC pipelines.
change-gate-reviewer
Reviews a single diff against the project quality contract: tags the change, scopes only the practices the change makes relevant, verifies diff coverage, checks that high-risk surface carries a recorded rationale, and returns severity-ranked findings with remediation briefs. Use before committing, pushing or opening a…
llm-feature-test-engineer
Designs and implements eval suites, runtime guardrail tests and adversarial prompt-injection suites for LLM-powered features, then wires the regression gate into CI. Use when a product ships prompts, agents or RAG and its quality is currently verified by eyeballing output, when a model or prompt upgrade needs a…