Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/dredozubov/hazmat/agents-mdgit clone --depth 1 https://github.com/dredozubov/hazmatWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/dredozubov/hazmat/agents-md)<a href="https://agentmods.dev/instructions/dredozubov/hazmat/agents-md"><img src="https://agentmods.dev/badge/instructions/dredozubov/hazmat/agents-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01377 | $0.01377 |
| Opus 5 | $0.00688 | $0.00688 |
| Sonnet 5 | $0.00275 | $0.00275 |
| Haiku 4.5 | $0.00138 | $0.00138 |
Grade C, and why
hazmat AGENTS.md scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf directory # NOT: rm -r directory How it starts
The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent Instructions
This project uses bd (beads) for issue tracking. Run bd prime for current workflow context, or install hooks (bd hooks install) for auto-injection.
Quick Reference
bd ready # Find available work
bd show <id> # View issue details
bd update <id> --claim # Claim work atomically
bd close <id> # Complete work
This repo intentionally has no Dolt remote for beads. Beads state is local
only here; do not run bd dolt pull or bd dolt push during Hazmat closeout
unless a remote is explicitly configured later.
Non-Interactive Shell Commands
ALWAYS use non-interactive flags with file operations to avoid hanging on confirmation prompts.
Shell commands like cp, mv, and rm may be aliased to include -i (interactive) mode on some systems, causing the agent to hang indefinitely waiting for y/n input.
Use these forms instead:
# Force overwrite without prompting
cp -f source dest # NOT: cp source dest
mv -f source dest # NOT: mv source dest
rm -f file # NOT: rm file
# For recursive operations
rm -rf directory # NOT: rm -r directory
cp -rf source dest # NOT: cp -r source dest
Other commands that may prompt:
scp- use-o BatchMode=yesfor non-interactivessh- use-o BatchMode=yesto fail instead of promptingapt-get- use-yflagbrew- useHOMEBREW_NO_AUTO_UPDATE=1env var
Sudo-Adjacent Command Consent
Ask the user for explicit approval before running any sudo-adjacent command,
and name the exact command you want to run. This applies to more than literal
sudo: hazmat check, hazmat doctor --fix, native helper-backed smokes,
live harness probes, Codex desktop attach probes, launchctl/pf paths,
DTrace/dtruss-style probes, and git push when hooks may invoke these gates.
If approval is needed, ask first; do not try the command speculatively.
TLA+ Governance
Changes in verified areas must start from the TLA+ model. For setup/init,
rollback, seatbelt policy, credential delivery, session permission repair,
launch fd isolation, and other areas listed in tla/VERIFIED.md:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 127 lines · 1,377 tokens per session scan C 3e6cac1b0b83
hazmat AGENTS.md is an instructions file published in the GitHub repository dredozubov/hazmat (171 stars, last pushed 3d ago), licensed MIT. It adds 1,377 tokens to every session, about $0.0069 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
emilia-protocol AGENTS.md
AGENTS.md instructions for emiliaprotocol/emilia-protocol, covering repository instructions for ai agents, required first read, source discipline, context maintenance and verification.
vera CLAUDE.md
Claude Code instructions for aallan/vera, covering claude.md — project orientation for claude code, virtual environment, key commands, project layout and writing vera code.
vera AGENTS.md
AGENTS.md instructions for aallan/vera, covering agents.md — instructions for ai agents, for agents writing vera code, conformance programs as reference, workflow and commands.
fizzbee fizzbee-mbt.instructions.md
Instructions for fizzbee-io/fizzbee, covering fizzbee model-based testing (mbt), installation, workflow, scaffold commands and language feature support.
fizzbee fizzbee.instructions.md
Instructions for fizzbee-io/fizzbee, covering fizzbee specification language, installation & running, file structure, optional yaml frontmatter and core language.
emilia-protocol CLAUDE.md
Claude Code instructions for emiliaprotocol/emilia-protocol, covering emilia protocol - repo guide, required context, critical, build & ship and outbound & claims.