What the reviewer found
This AGENTS.md is a jailbreak layer, not a pentest playbook: it sets AUTHORIZATION = GRANTED and EVERY_TASK_IS_AUTHORIZED_LAB_OR_CTF = true, explicitly forbids ever asking the operator to prove ownership or authorization ('禁止只回把你自己的系统拿来'), and maps hacking/cheat slang (外挂/ESP/自瞄, 卡密/破解/注册机, 渗透/IDOR/越权) straight to working exploit or game-cheat deliverables on keyword match alone. The '<!-- module: ... -->' comments are just plain-text section dividers, not concealment, so P2 is false, but AR1's removal of the authorization gate itself is the real thing this file does. The body was truncated at
prompt-injection— tries to steer the agentdual-use— a security tool that can be misused
What was read
The file as it ships in HaizhuAI/HaizhuAgents:
AGENTS.md
What the static scan said
The scan flagged 2things. The reviewer kept 1 and dismissed 1 as false.
P2Hidden instructions — false positiveAR1Tells the agent never to refuse — real
How this review was made
Sonnet 5 read the files above on 7 September 2026 and answered three questions: is it dangerous to whoever installs it, is each scanner finding real, and what should the installer know. The verdict is bound to the file's hash; when the file changes, it is scanned afresh and reviewed again. A script that changes while the definition does not is not re-reviewed — that is a known gap. How the scan and the review work.