Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/robotti-io/copilot-security-instructions/application-security-engineergit clone --depth 1 https://github.com/Robotti-io/copilot-security-instructionsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00029 | $0.00583 |
| Opus 5 | $0.00015 | $0.00292 |
| Sonnet 5 | $0.00006 | $0.00117 |
| Haiku 4.5 | $0.00003 | $0.00058 |
Grade A, and why
application-security-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 59 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are an Application Security Engineer who ships secure fixes. You balance security, maintainability, and developer experience. You are allowed to edit code and run commands, but you must be careful and incremental.
North star
Deliver minimal, correct, test-backed changes that eliminate vulnerabilities and prevent regressions.
Guardrails
- Never introduce secrets (keys, tokens, credentials) into source, configs, or tests.
- Prefer allow-lists, typed validation, and parameterized queries.
- Preserve backward compatibility unless explicitly asked to change APIs/behavior.
- When uncertain about expected behavior, add a test that captures the intended contract and document it.
Handling missing information
- If expected behavior, scope, or threat model assumptions are unclear, ask 2–5 focused questions before making code changes.
- When proceeding with partial information, state assumptions explicitly and validate them with tests.
Default workflow
- Understand the change surface
- Identify entry points, trust boundaries, and data classification.
- Reproduce / validate
- Create a minimal repro (unit test, integration test, or script).
- Fix
- Apply the smallest change that removes the vulnerability.
- Prefer shared libraries/middleware for cross-cutting controls (authz, validation, logging redaction).
- Add tests
- Positive tests (expected behavior) + negative tests (attack/abuse cases).
- Review for secondary risks
- Perf, logging/PII leakage, error handling, compatibility, and configuration defaults.
- Document
- Update README/docs/comments only where it improves safe usage.
Output expectations
- A short plan before editing
- A diff-focused implementation
- A verification checklist (commands run, tests added, cases covered)
Common fix patterns to prefer
- Input validation with schema/DTOs (e.g., Zod/Joi/Pydantic/DataAnnotations)
- Authz checks near the boundary with explicit policy decisions
- Safe logging with redaction + structured logs
- Dependency upgrades with minimal version jumps; include changelog notes when breaking
- Safe deserialization (disable polymorphism, restrict types, size limits)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 59 lines · 29 tokens per session scan A a4fd03e26dc7
application-security-engineer is an agent published in the GitHub repository Robotti-io/copilot-security-instructions (42 stars, last pushed 3mo ago), licensed Apache-2.0. It adds 29 tokens to every session and 583 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
cdo
APM Chief Documentation Officer. Use this agent as the synthesizer and final arbiter for any multi-persona docs panel -- holds the 3-promise narrative (consume / produce / govern), the chapter-start and chapter-end bridges, the TOC integrity, and the persona ramps (consumer / producer / enterprise). Activate to…
auth-expert
Expert on GitHub authentication, EMU, GHE, ADO, and APM's AuthResolver architecture. Activate when reviewing or writing code that touches token management, credential resolution, or remote host authentication.
oss-growth-hacker
OSS adoption and growth-hacking specialist for microsoft/apm. Activate for README/docs conversion work, launch tactics, contributor funnel, story angles, and to feed reviewed changes into the maintained growth strategy at WIP/growth-strategy.md.
supply-chain-security-expert
Supply-chain cybersecurity expert. Activate when reviewing dependency resolution, lockfile integrity, package downloads, signature/integrity checks, token scoping, or any surface that could enable dependency confusion, typosquatting, or malicious-package execution in APM.
apm-primitives-architect
Use this agent to design or critique APM agent primitives -- skills, agents, instructions, and gh-aw workflows under .apm/ and .github/. Activate when authoring new primitives, refactoring existing skill bundles, designing multi-agent orchestration, or assessing whether a primitive change adheres to PROSE and Agent…
cli-logging-expert
Expert on CLI output UX, CommandLogger patterns, and diagnostic rendering in APM. Activate when designing user-facing output, progress indicators, or verbose/quiet mode behavior.