Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/deep-copilot/deepcopilot/copilot-instructionsgit clone --depth 1 https://github.com/deep-copilot/DeepCopilotWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00640 | $0.00640 |
| Opus 5 | $0.00320 | $0.00320 |
| Sonnet 5 | $0.00128 | $0.00128 |
| Haiku 4.5 | $0.00064 | $0.00064 |
Grade A, and why
DeepCopilot copilot-instructions.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
DeepCopilot 项目级 Copilot / AI 审核指引
本文件会被 GitHub Copilot Code Review、Copilot Chat 以及
.github/workflows/ai-review.yml中的 DeepSeek 审核器读取，作为审查 PR 时的项目上下文。
项目概述
DeepCopilot 是一个 VS Code 扩展，核心能力：
- 通过 DeepSeek API 提供对话式编程助手
- 在 webview 中渲染聊天 UI（
media/、src/webview/） - 通过工具调用（
src/tools/）让模型读写文件、执行命令、抓取网页 - 提供 MCP 集成（
src/mcp.js）和技能（skills）扩展点
技术栈
- Node.js + JavaScript（不是 TS）
- VS Code Extension API
- esbuild 打包（
esbuild.config.js） - Webview + 原生 HTML/CSS/JS（KaTeX、DOMPurify）
审查时必须关注的红线
- 密钥与凭据：禁止把 API Key、token 硬编码进任何文件；禁止在日志/异常里打印完整 key。
- 命令执行安全：
src/tools/exec.js、src/tools/shell.js涉及命令执行，必须确认：- 不接受未经检查的用户拼接命令
- 没有
shell: true+ 用户输入直拼
- 文件系统：
src/tools/file-read.js、file-write.js要确认路径在工作区内，防止..路径穿越。 - Webview CSP：
src/webview/html.js修改时，CSP 不能放宽到unsafe-eval、unsafe-inline（除已存在的 nonce 模式）。 - 网络抓取：
src/tools/web-fetch.js、web-search.js不得绕过用户授权、不得允许file://、localhostSSRF。 - 依赖变更：
package.json增删依赖必须在 PR 描述里说明用途，拒绝引入已知废弃 / 高危包。
代码风格
- 使用 2 空格缩进、单引号、必要时分号
- 错误必须通过
src/errors.js中的工具处理，不要console.log调试代码 - 国际化文案统一通过
src/utils/i18n.js - 路径相关用
src/utils/paths.js，不要直接拼字符串
审核结论格式
请在审查最后一行给出明确结论：
结论：通过 / 需修改 / 拒绝
需修改 / 拒绝时必须列出具体修改项，便于贡献者跟进。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 41 lines · 640 tokens per session scan A 0ceda91abd2f
DeepCopilot copilot-instructions.md is an instructions file published in the GitHub repository deep-copilot/DeepCopilot (78 stars, last pushed 21d ago), licensed MIT. It adds 640 tokens to every session, about $0.0032 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
ds4-control CLAUDE.md
Instructions for notatestuser/ds4-control, covering ds4 control — project guide for claude, purpose, deepseek v4 preview maintenance, stack and dev workflow.
carboncode AGENTS.md
Instructions for Yapie0/carboncode, covering agents.md, project context, current status, product direction and chosen base.
carboncode CLAUDE.md
Instructions for Yapie0/carboncode, covering claude.md, canonical rules (authoritative — follow these), dev workflow, architecture map (src/) and conventions.
feima-copilot-llms-extension copilot-instructions.md
Instructions for feimacode/feima-copilot-llms-extension, covering feima copilot llms extension - copilot instructions, localization and 1. runtime strings — l10n/bundle.l10n.zh-cn.json.
alice AGENTS.md
Instructions for Alice-space/alice, covering agents collaboration guide (alice), scope, repo-local skills first, 1. decision discipline and 2. change scope rules.
kana AGENTS.md
Instructions for longyijdos/kana, covering agents.md, scope and workflow, implementation, tests and documentation.