Borrowing it
Nothing to install: this file belongs to deep-copilot/DeepCopilot. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/deep-copilot/DeepCopilot/main/.github/copilot-instructions.mdgit clone --depth 1 https://github.com/deep-copilot/DeepCopilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/deep-copilot/deepcopilot/copilot-instructions)<a href="https://agentmods.dev/instructions/deep-copilot/deepcopilot/copilot-instructions"><img src="https://agentmods.dev/badge/instructions/deep-copilot/deepcopilot/copilot-instructions/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/deep-copilot/deepcopilot/copilot-instructions"><img src="https://agentmods.dev/badge/instructions/deep-copilot/deepcopilot/copilot-instructions.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00640 | $0.00640 |
| Opus 5.5 | $0.00256 | $0.00256 |
| Sonnet 5.5 | $0.00128 | $0.00128 |
| Haiku 4.5 | $0.00064 | $0.00064 |
Grade A, and why
DeepCopilot copilot-instructions.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
DeepCopilot 项目级 Copilot / AI 审核指引
本文件会被 GitHub Copilot Code Review、Copilot Chat 以及
.github/workflows/ai-review.yml中的 DeepSeek 审核器读取，作为审查 PR 时的项目上下文。
项目概述
DeepCopilot 是一个 VS Code 扩展，核心能力：
- 通过 DeepSeek API 提供对话式编程助手
- 在 webview 中渲染聊天 UI（
media/、src/webview/） - 通过工具调用（
src/tools/）让模型读写文件、执行命令、抓取网页 - 提供 MCP 集成（
src/mcp.js）和技能（skills）扩展点
技术栈
- Node.js + JavaScript（不是 TS）
- VS Code Extension API
- esbuild 打包（
esbuild.config.js） - Webview + 原生 HTML/CSS/JS（KaTeX、DOMPurify）
审查时必须关注的红线
- 密钥与凭据：禁止把 API Key、token 硬编码进任何文件；禁止在日志/异常里打印完整 key。
- 命令执行安全：
src/tools/exec.js、src/tools/shell.js涉及命令执行，必须确认：- 不接受未经检查的用户拼接命令
- 没有
shell: true+ 用户输入直拼
- 文件系统：
src/tools/file-read.js、file-write.js要确认路径在工作区内，防止..路径穿越。 - Webview CSP：
src/webview/html.js修改时，CSP 不能放宽到unsafe-eval、unsafe-inline（除已存在的 nonce 模式）。 - 网络抓取：
src/tools/web-fetch.js、web-search.js不得绕过用户授权、不得允许file://、localhostSSRF。 - 依赖变更：
package.json增删依赖必须在 PR 描述里说明用途，拒绝引入已知废弃 / 高危包。
代码风格
- 使用 2 空格缩进、单引号、必要时分号
- 错误必须通过
src/errors.js中的工具处理，不要console.log调试代码 - 国际化文案统一通过
src/utils/i18n.js - 路径相关用
src/utils/paths.js，不要直接拼字符串
审核结论格式
请在审查最后一行给出明确结论：
结论：通过 / 需修改 / 拒绝
需修改 / 拒绝时必须列出具体修改项，便于贡献者跟进。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 41 lines · 640 tokens per session scan A 0ceda91abd2f
DeepCopilot copilot-instructions.md is an instructions file published in the GitHub repository deep-copilot/DeepCopilot (79 stars, last pushed 1mo ago), licensed MIT. It adds 640 tokens to every session, about $0.0026 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
deepseek-harness AGENTS.md
AGENTS.md instructions for deepseek-ai/deepseek-harness, covering agents.md, pre-stable apis and released session data, repository layout, commands and host sandbox failures.