Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/crystian/skill-map/agents-mdgit clone --depth 1 https://github.com/crystian/skill-mapWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.09982 | $0.09982 |
| Opus 5 | $0.04991 | $0.04991 |
| Sonnet 5 | $0.01996 | $0.01996 |
| Haiku 4.5 | $0.00998 | $0.00998 |
Grade D, and why
skill-map AGENTS.md scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
- **Skill-map MUST NEVER read `$HOME` by default. There is no global / user scope.** No `-g/--global` flag, no `SKILL_MAP_SCOPE` env var, no silent merge of `~/.skill-map/settings*.json` into the project config layer sys Enumerates other installed skillsmediumAgent snooping
Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.
- **No hacks, read the official docs first.** When integrating any third-party library, framework, or SDK: read its installation + setup docs BEFORE writing code. If code doesn't work as expected, re-read the docs before How it starts
The opening of the file, as written. The whole thing — 136 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md
Operating manual for AI agents working on skill-map. Day-to-day agent guidance only; the product overview lives in README.md and the full design narrative in ROADMAP.md. Topical deep-dives live in context/*.md, load them on demand when entering the relevant area.
Authority order when sources disagree: spec/ > ROADMAP.md > AGENTS.md (and its context/*.md annexes, same level). Spec is always source of truth for the standard. ROADMAP.md is the canonical design narrative and planning authority. AGENTS.md is the current agent operating guide and must be updated when it lags behind the roadmap. This authority order is absolute: when AGENTS.md disagrees with ROADMAP.md, ROADMAP.md wins and AGENTS.md is the thing to fix; when either disagrees with spec/, spec wins.
Language & persona activation (READ FIRST)
This is a strict gate. Evaluate the user's FIRST message before doing anything else.
- IF the user's first message is written in Spanish (with or without a greeting like "hola", "buenas", "qué tal", "buen día", "buenos días", "buenas tardes", "buenas noches"):
- Switch into the Arquitecto persona (see next section). Respond in Spanish from that message onward.
- ELSE (message is in English or any other language):
- Do NOT activate the Arquitecto persona. Respond in the user's language. Use default Claude behavior and tone. Do not call yourself "Claudio". Do not use the Spanish greeting response. Do not address the user by any persona name.
- This applies even if later messages contain Spanish words, the first message sets the mode for the whole session.
Always apply (both modes):
- Paths: prefer relative paths over absolute paths in bash commands and agent prompts.
- Temp files: use
.tmp/(project-local) instead of/tmp/. - Language in artifacts: code, commits, PRs, and all documentation in English, regardless of conversation language.
- No em dashes (
—) in written text: prefer a comma or parentheses. Applies to commits, PRs, docs, UI/CLI strings, plugin descriptions, comments. Reason: stylistic preference, em dashes feel AI-generated. ASCII hyphens (-) in code, paths, or CLI flags are unaffected. The historical sweep landed in v0.22.x and covers every tracked file undersrc/**/*.{ts,js},web/, and the in-repo*.mddocs (root,spec/,context/, workspace READMEs); fixture markdown underfixtures/and historicalCHANGELOG.mdsnapshots are intentionally left untouched. New em dashes in**/*.texts.tscatalog files are blocked at lint time by theno-restricted-syntaxrule insrc/eslint.config.js; in any other file the rule is enforced by code review, swap the em dash for the punctuation that reads best in context. - No hard-wrapping in prose: one paragraph = one physical line. When writing or editing Markdown / text prose (docs, drafts, posts, notes, generated reports), never insert physical line breaks to wrap a paragraph at some column width; let the editor soft-wrap. Line breaks are STRUCTURAL only: between paragraphs, list items, headers, table rows, and inside code blocks. Reason: hard-wrapped text breaks copy-paste into external surfaces (Reddit, mail clients, chat) and pollutes diffs when a paragraph is edited. This applies to every agent-written text file in and around this project.
- Built-in extensions do NOT declare a per-extension
version. Built-ins ship with the CLI, so they inherit the CLI version. Authoring a<plugin>/<kind>s/<name>/index.tsundersrc/plugins/: type the export asIBuiltInManifest<I<Kind>>(fromkernel/extensions/index.js), which isOmit<I<Kind>, 'version'>, and omit theversionline entirely. The codegen atscripts/generate-built-ins.jsstamps the CLI version fromsrc/package.jsononto every built-in (alongside thepluginIdstamp) when emittingsrc/plugins/built-ins.ts, so the runtime object satisfies the full kind interface (e.g.IAnalyzer) and downstream consumers continue to seeext.versionas a non-empty string. External plugins (loaded from disk at runtime) MUST still declareversionper-extension; that's enforced by AJV at load time viaspec/schemas/extensions/base.schema.json#/required. There is no "stub" sentinel anymore: a placeholder is just an extension whose body returns[]/{ ok: true, noop: true }/ similar, with no version chrome to flag it (the chip was retired in v0.40). If we later want a visible stub signal, use a dedicatedstability: 'stub'field rather than overloadingversion.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 136 lines · 9,982 tokens per session scan D 47d21df6f124
skill-map AGENTS.md is an instructions file published in the GitHub repository crystian/skill-map (59 stars, last pushed 2d ago), licensed MIT. It adds 9,982 tokens to every session, about $0.0499 per session on Opus 5. A static security scan graded it D with 2 findings (reaches for credential files, enumerates other installed skills). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
ratel AGENTS.md
Instructions for ratel-ai/ratel, covering agents.md — working in the ratel repo, build & test, rust, ts and python (from src/sdk/python/; needs uv).
agentregistry copilot-instructions.md
Instructions for agentregistry-dev/agentregistry, covering github copilot instructions and keeping the pr description up-to-date.
loom CLAUDE.md
Instructions for cosmix/loom, covering claude.md, project overview, build commands, architecture and source layout (loom/src/).
copilot AGENTS.md
Instructions for navikt/copilot, covering agents.md for navikt/copilot, what this repo is, efficiency rule, standard commands and conventions.
research-os AGENTS.md
Instructions for lxinfei5/research-os, covering researchos — constitution, §0 what this is, §1 directory discipline, §2 half-life (innovation 1) — memory design and §3 behavior pillars (innovations 2–5).
skills AGENTS.md
Instructions for tomimor/skills, covering agents.md, repo structure, adding a new own skill, own skill conventions and adding a new vendor skill set.