Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/dryvist/ai-workflows/copilot-instructionsgit clone --depth 1 https://github.com/dryvist/ai-workflowsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00767 | $0.00767 |
| Opus 5 | $0.00383 | $0.00383 |
| Sonnet 5 | $0.00153 | $0.00153 |
| Haiku 4.5 | $0.00077 | $0.00077 |
Grade A, and why
ai-workflows copilot-instructions.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GitHub Copilot Instructions — ai-workflows
Repository Purpose
Reusable GitHub Actions workflows for AI-assisted automation. Consumer repos call these with thin callers (~10-20 lines). This is the single source of truth for CI/CD automation workflows.
Build & Test
- Package manager: bun (not npm or node)
- Run tests:
bun test - Watch mode:
bun test --watch - bun is globally available; no install step needed
File Structure Rules
Each file must contain a single language — never mix:
.ymlfiles: YAML only (workflow configuration).jsfiles: JavaScript only (logic — one script per purpose).mdfiles: prompts with${VAR}placeholders for dynamic values.jsonfiles: configuration only
Inline threshold: Scripts of 5 lines or fewer may be embedded in YAML run: steps.
Scripts exceeding 5 lines must be extracted to .github/scripts/<workflow-name>/<script>.js.
JavaScript Script Pattern
All scripts use this module pattern:
module.exports = async ({ github, context, core }) => {
// logic here
};
Pass GitHub Actions expression values (${{ }}) via env: on the step, then read with
process.env in the script. Never interpolate expressions inside .js files.
Invoke extracted scripts in YAML:
- uses: actions/github-script@v8
env:
MY_VAR: ${{ steps.prev.outputs.value }}
with:
script: |
const run = require('./.ai-workflows/.github/scripts/<dir>/<name>.js');
await run({ github, context, core });
Testing Requirements
- Framework: bun:test (built-in globals: describe, it, expect, beforeEach)
- One test file per script:
tests/<script-name>.test.js - Mock factories in
tests/helpers.js— usecreateMockCore,createMockContext,createMockGithub - Use
mock()frombun:testfor mock functions - Every new script must include a test: happy path + key failure modes
Prompt Files
Prompts live in dryvist/ai-llm-prompts under automation/ with ${VAR}
placeholders. Workflows pin an immutable catalog commit and render with
.github/scripts/render-prompt.sh, which strips OKF frontmatter before
envsubst.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 89 lines · 767 tokens per session scan A 69f862cc3f32
ai-workflows copilot-instructions.md is an instructions file published in the GitHub repository dryvist/ai-workflows (5 stars, last pushed 4d ago), licensed MIT. It adds 767 tokens to every session, about $0.0038 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
claude-prompts-mcp CLAUDE.md
Claude Code instructions for minipuft/claude-prompts-mcp, covering claude prompts mcp -- operator handbook, core principles, node.js support boundaries, validation gates (one contract, impact-aware subsets) and fleet standards upstream (minipuft/repository-standards).
claude-prompts-mcp AGENTS.md
AGENTS.md instructions for minipuft/claude-prompts-mcp, covering agent rules · claude prompts mcp, canonical ownership and loading, core principles, node.js support boundaries and validation gates (one contract, impact-aware subsets).
scrub-mcp AGENTS.md
AGENTS.md instructions for zombat/scrub-mcp, covering s.c.r.u.b. agent instructions, prime directive, prohibited actions (the bash ban), division of labor and context gathering rules (map-then-navigate).
dxkit CLAUDE.md
Instructions for vyuh-labs/dxkit, covering claude.md — dxkit development rules, architecture rules, 1. tool invocation goes through the registry, 2. never duplicate tool invocation logic and 3. language facts come from detect.ts.
mcp-server-powerpoint code-review.instructions.md
Instructions for sbroenne/mcp-server-powerpoint, covering copilot code review, interop and resource safety, contract and path completeness and protocol, tests, and user-facing surfaces.
ai-marketplace AGENTS.md
Instructions for Kong/ai-marketplace, covering skill authoring guide, what belongs here, before you create a skill, what a good skill does and layered skill design.