AiSOC AGENTS.md

A set of project instructions that records user preferences and facts about a workspace. It tells a coding agent how to track work, handle documentation, protect secrets, and maintain the repository.

In plain words
What is it for?
Use it to guide task planning, repository maintenance, documentation updates, secret checks, GitHub publishing, and progress tracking.
Why use it?
It reduces repeated explanations and keeps the agent’s work consistent across sessions. It also records rules for safe publishing and honest reporting of data.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/beenuar/aisoc/agents-md
Clone the repo
git clone --depth 1 https://github.com/beenuar/AiSOC

Made for: Codex, OpenCode.

Per session 6,497 This file is loaded in full into every session.
When invoked 6,497 The same file — it is already loaded in full.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.06497 $0.06497
Opus 5 $0.03248 $0.03248
Sonnet 5 $0.01299 $0.01299
Haiku 4.5 $0.00650 $0.00650

Measured 2d ago against content hash afa70f612b10, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

AiSOC AGENTS.md scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- **Devcontainer prebuilt image.** `.devcontainer/devcontainer.json` prefers `ghcr.io/beenuar/aisoc-devcontainer:latest` (with local Dockerfile fallback). `.github/workflows/devcontainer-build.yml` publishes multi-arch (
AGENTS.md · 87 lines

How it starts

The opening of the file, as written. The whole thing — 87 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Learned User Preferences

  • Always track progress locally (e.g. in a TODO/PROGRESS file) so work can be resumed after IDE crashes or restarts.
  • Complete all planned tasks without stopping mid-way; work through the full list until done.
  • Do not mention competitor names (Prophet Security, Torq) anywhere in code, comments, or docs — this is an open-source project.
  • Before pushing to GitHub, ensure no secrets, API keys, tokens, or sensitive data are present in any public repo files.
  • Host codebase on GitHub once fully built out; keep documentation in sync.
  • Never edit plan files directly — implement the plan as specified without modifying the plan document itself.
  • After every significant change, push code and update documentation on GitHub immediately — don't wait to be asked.
  • Benchmark data and documentation must be transparent about what is synthetic vs. real; never present fabricated metrics as actual measured performance.
  • When the task is clear, act autonomously — don't ask unnecessary clarifying questions.
  • Standing repo-maintenance loop is the default when no other task is queued: review open PRs at the canonical repo, resolve CI/conflicts, merge them, close issues those PRs resolved, and keep main green.
  • After any deploy to tryaisoc.com, do an end-to-end customer-journey review that covers the full authenticated app (registration → login → connector setup → live ingest/triage → billing), not just landing → dashboard: click through every interactive element and fix dead buttons, broken flows, and empty/errored views before declaring done. The user repeatedly reports broken authenticated features post-deploy and demands being "1000% sure" nothing is broken before any handover.
  • The authenticated product must run on real, live connector-ingested data and genuine LLM triage — never mock/demo/baseline-fallback or empty data presented as working. When a user connects a connector, the platform must automatically and continuously (near-real-time) pull and analyze that data for triage without the user having to ask; stubbed features, empty dashboards, and silent mock-data fallbacks are treated as bugs.
  • When asked "what else can we improve?" / "what are the missing pieces?" / "make this world-class", produce a concrete competitive gap analysis vs. leading commercial AI-SOC products and implement the gaps — don't just answer in prose.

Read the full file on GitHub · 87 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 87 lines · 6,497 tokens per session scan A afa70f612b10

Subscribe to this mod's changes

AiSOC AGENTS.md is an instructions file published in the GitHub repository beenuar/AiSOC (2,363 stars, last pushed 2d ago), licensed MIT. It adds 6,497 tokens to every session, about $0.0325 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other instructions, from other repositories