Borrowing it
Nothing to install: this file belongs to BoxLogoDev/sapstack. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/BoxLogoDev/sapstack/main/.kiro/steering/sapstack-universal-rules.mdgit clone --depth 1 https://github.com/BoxLogoDev/sapstackWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/boxlogodev/sapstack/sapstack-universal-rules)<a href="https://agentmods.dev/instructions/boxlogodev/sapstack/sapstack-universal-rules"><img src="https://agentmods.dev/badge/instructions/boxlogodev/sapstack/sapstack-universal-rules/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/boxlogodev/sapstack/sapstack-universal-rules"><img src="https://agentmods.dev/badge/instructions/boxlogodev/sapstack/sapstack-universal-rules.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00430 | $0.00430 |
| Opus 5.5 | $0.00172 | $0.00172 |
| Sonnet 5.5 | $0.00086 | $0.00086 |
| Haiku 4.5 | $0.00043 | $0.00043 |
Grade A, and why
sapstack sapstack-universal-rules.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
sapstack Universal Rules
이 steering 파일은 sapstack을 사용하는 모든 Kiro 세션에 항상 주입됩니다. 8개의 Universal Rule은 SAP 작업의 안전성·재현성·감사 추적성을 보장합니다.
원본 규칙 (복사 아님, 참조)
아래 참조는 원본 파일을 실시간으로 주입합니다. sapstack을 업데이트하면 자동으로 최신 규칙이 반영됩니다.
#[[file:CLAUDE.md]]
이 steering이 주입되면 Kiro가 다음을 수행합니다
- SAP 관련 요청이 들어오면 환경 컨텍스트(ECC/S4, 배포 모델, 업종)를 먼저 질문
- 어떤 코드 생성·리뷰에서도 회사코드·GL·코스트 센터 등을 하드코딩하지 않음
- ECC와 S/4HANA 동작이 다른 경우 반드시 구분
- 설정 변경에는 Transport Request 필수 명시
- AFAB·F.13·F110 등 위험 작업은 Test Run 선행 안내
- 프로덕션 SE16N 데이터 편집 절대 권고 금지
- 모든 액션에 T-code + 메뉴 경로 둘 다 제공
- 한국어 응답은 현장체 + 이중 병기 (Rule #8 — 별도 steering 참조)
관련 steering
sapstack-korean-field-language.md— Rule #8 현장체 원칙 상세sapstack-evidence-loop.md— 복잡 진단 시 Turn-aware 응답 포맷sapstack-symptom-context.md— 자연어 증상 매칭 사전
우선순위
이 steering은 프로젝트 루트의 AGENTS.md와 함께 always 모드로 주입됩니다.
충돌 시 더 구체적인 rule이 우선(예: Rule #8은 일반적인 한국어 응답보다 구체적).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 38 lines · 430 tokens per session scan A 28bd07036ee0
sapstack sapstack-universal-rules.md is an instructions file published in the GitHub repository BoxLogoDev/sapstack (20 stars, last pushed 19d ago), licensed MIT. It adds 430 tokens to every session, about $0.0017 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-15.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
deepseek-harness AGENTS.md
AGENTS.md instructions for deepseek-ai/deepseek-harness, covering agents.md, pre-stable apis and released session data, repository layout, commands and host sandbox failures.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).