agentmods.dev

appicon AGENTS.md

Project instructions for appicon, a command-line and MCP tool that resolves desktop and brand icons to local file paths. A cache stores previously resolved results for reuse.

In plain words
What is it for?
Use them when developing or changing appicon’s CLI, MCP wrapper, providers, cache, path handling, documentation, or tests.
Why use it?
They set rules for safe caching, downloads, credentials, archive handling, fallbacks, and optional daemon use, reducing security and reliability mistakes.

Instructions file for CodexOpenCode

1 17d ago A scan 291 tokens original MIT
View the source file bolens/appicon
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/bolens/appicon/agents-md
Clone the repo
git clone --depth 1 https://github.com/bolens/appicon

Made for: Codex, OpenCode.

Per session 291 This file is loaded in full into every session.
When invoked 291 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00291 $0.00291
Opus 5 $0.00146 $0.00146
Sonnet 5 $0.00058 $0.00058
Haiku 4.5 $0.00029 $0.00029

Measured yesterday against content hash 2a4bb2ed5139, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

appicon AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 24 lines

What it actually says

Agent notes

  • Keep resolution cache-first. A warm cache must not contact a remote provider, and tests must use fixtures or httptest, never live services.
  • Consumers receive local paths from the CLI or MCP server. Do not move provider URLs or download logic into consumer repositories, and keep MCP as a thin wrapper over the shared resolver.
  • A resolve miss (exit 1) is supported behavior. Consumers must retain their fallback glyph and must not require appicon to start.
  • Remote hosts stay allowlisted. BYOK configuration stores only environment variable names (token_env/secret_env), never credentials; missing credentials skip the stage and appear as stage(auth) in explanations.
  • Treat pack archives, indexes, subdirectories, and install destinations as hostile input. Preserve path containment, extraction limits, and safe wipe boundaries.
  • Prefer user overrides for long-tail remaps instead of speculative built-in aliases. Do not vendor the full SVGL catalog.
  • The daemon is optional and unsupported on Windows; all CLI operations must continue to work in-process.
  • Start documentation changes at docs/README.md, and keep the linked contract/schema pages synchronized.
  • Test new behavior and edge cases, then run make check-fast; run make check before handing off or committing release-bound work.
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 24 lines · 291 tokens per session scan A 2a4bb2ed5139

Subscribe to this mod's changes

appicon AGENTS.md is an instructions file published in the GitHub repository bolens/appicon (1 stars, last pushed 17d ago), licensed MIT. It adds 291 tokens to every session, about $0.0015 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

LanguagesTestingWriting and docscligoiconsmcprofisvg
Related

Other instructions, from other repositories

thesvg AGENTS.md

AGENTS.md instructions for glincker/thesvg, covering thesvg - ai review guidelines, svg icon submission rules, required, fill and color rules and icons.json registry.

glincker/thesvg · 844 tokens

ollama CLAUDE.md

Claude Code instructions for ollama/ollama: See AGENTS.md for the shared agent instructions for this repository.

ollama/ollama · 21 tokens

joint CLAUDE.md

Instructions for clientIO/joint, covering claude.md, project overview, common commands, install dependencies and build distribution files (runs grunt).

clientIO/joint · 1,220 tokens

sq AGENTS.md

Instructions for neilotoole/sq, covering agents.md, about sq, key documents, common commands and conventions.

neilotoole/sq · 3,837 tokens

azure-sdk-for-go go-examples.instructions.md

Instructions for Azure/azure-sdk-for-go, a project described as: This repository is for active development of the Azure SDK for Go. For consumers of the SDK we recommend visiting our public developer docs at.

Azure/azure-sdk-for-go · 113 tokens

cli AGENTS.md

Instructions for planetscale/cli, covering planetscale cli — agent guide, public repository safety, concepts, flag placement and correct.

planetscale/cli · 9,971 tokens