Borrowing it
Nothing to install: this file belongs to HeadyZhang/agent-audit. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/HeadyZhang/agent-audit/master/CLAUDE.mdgit clone --depth 1 https://github.com/HeadyZhang/agent-auditWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/headyzhang/agent-audit/claude-md)<a href="https://agentmods.dev/instructions/headyzhang/agent-audit/claude-md"><img src="https://agentmods.dev/badge/instructions/headyzhang/agent-audit/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/headyzhang/agent-audit/claude-md"><img src="https://agentmods.dev/badge/instructions/headyzhang/agent-audit/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.03542 | $0.03542 |
| Opus 5.5 | $0.01417 | $0.01417 |
| Sonnet 5.5 | $0.00708 | $0.00708 |
| Haiku 4.5 | $0.00354 | $0.00354 |
Grade A, and why
agent-audit CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 208 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent Audit (Argus) — Project Context for Claude Code
Overview
Agent Audit is a security scanner for AI agent code, MCP configurations, and DeFi contracts. It detects agent-specific vulnerabilities that traditional SAST tools miss, mapped to the OWASP Agentic Top 10 (2026) with 10/10 coverage.
- Version: 0.20.0
- Python: 3.9–3.14 (
packages/audit/pyproject.tomldeclares^3.9and classifiers through 3.14; this branch isfix/py314-blockerand the suite runs on CPython 3.14.3) - License: MIT
- Entry point:
agent-audit = "agent_audit.cli.main:cli" - Metrics (v0.20.0, 2026-08-11, GT v2.2 / 81 samples / 238 labels): P 68.86% / R 84.32% / F1 0.7581 (raw, reproducible) — TP 199 / FP 90 / FN 37. Reproduce:
cd packages/audit && python3 ../../tests/benchmark/precision_recall.py. Suite:pytest tests/ packages/audit/tests/→ 1,924 passed, 1 failed, 4 skipped; the failure istests/test_corpus_label_rules.py, committed red on purpose (three ground-truth labels cite AGENT-015, which no code path can emit — seedocs/decisions/AGENT-015_RESOLUTION.md§ 4). Read FP 90 as pessimistic: at least 21 are correct by their rules' own definitions and merely unlabelled. No adjusted figure is published. A post-hoc 0.84 was previously derived by excluding FPs from post-v0.16 rules;docs/decisions/METRICS_RETRACTION.md§ 3(b) explains why a bound is stated instead.
Repository Structure
agent-security-suite/
├── packages/audit/ # Main Python package
│ ├── agent_audit/
│ │ ├── __init__.py
│ │ ├── version.py # __version__ = "0.18.2"
│ │ ├── analysis/ # 21 analyzer modules (confidence scoring, taint, context)
│ │ │ ├── semantic_analyzer.py # 3-stage credential detection (regex → value → context)
│ │ │ ├── taint_tracker.py # Data flow: source → sanitizer → sink
│ │ │ ├── tool_boundary_detector.py # @tool entry point gate for AGENT-034
│ │ │ ├── ts_tool_boundary_detector.py
│ │ │ ├── confidence_matrix.py # Tier computation and adjustment rules
│ │ │ ├── context_classifier.py # File type detection (test/example/infra)
│ │ │ ├── dangerous_operation_analyzer.py
│ │ │ ├── framework_detector.py # Pydantic/LangChain/CrewAI internal suppression
│ │ │ ├── placeholder_detector.py
│ │ │ ├── value_analyzer.py
│ │ │ ├── identifier_analyzer.py
│ │ │ ├── tool_description_analyzer.py
│ │ │ ├── memory_method_detector.py
│ │ │ ├── env_tracer.py
│ │ │ ├── entropy.py
│ │ │ └── rule_context_config.py
│ │ ├── analyzers/
│ │ │ └── memory_context.py
│ │ ├── scanners/ # 14 scanner modules
│ │ │ ├── base.py # BaseScanner ABC
│ │ │ ├── python_scanner.py # 4017 LOC — AST-based Python analysis
│ │ │ ├── typescript_scanner.py # 952 LOC — TS/JS via tree-sitter
│ │ │ ├── go_scanner.py # 296 LOC — Go patterns
│ │ │ ├── solidity_scanner.py # 411 LOC — Solidity contracts
│ │ │ ├── secret_scanner.py # 855 LOC — Regex + semantic secret detection
│ │ │ ├── config_scanner.py # 390 LOC — YAML/JSON/ENV files
│ │ │ ├── mcp_config_scanner.py # 1369 LOC — MCP config auditing
│ │ │ ├── mcp_baseline.py # 530 LOC — MCP baseline drift (rug pull)
│ │ │ ├── mcp_inspector.py # 607 LOC — Live MCP server introspection
│ │ │ ├── privilege_scanner.py # 1138 LOC — OS privilege escalation
│ │ │ ├── skill_body_scanner.py # 402 LOC — OpenClaw skill instructions
│ │ │ ├── skill_meta_scanner.py # 352 LOC — OpenClaw skill metadata
│ │ │ └── __init__.py
│ │ ├── rules/
│ │ │ ├── engine.py # RULE_CWE_MAPPING (86 entries), PATTERN_TYPE_TO_RULE_MAP (60+ patterns)
│ │ │ ├── loader.py # YAML rule loader
│ │ │ └── builtin/ # YAML rule definitions (mirrored from monorepo)
│ │ │ ├── owasp_agentic_v2.yaml
│ │ │ ├── owasp_agentic.yaml
│ │ │ ├── asi_coverage_v030.yaml
│ │ │ ├── mcp_security_v030.yaml
│ │ │ └── langchain_security_v030.yaml
│ │ ├── models/
│ │ │ ├── finding.py # Finding dataclass, confidence_to_tier(), TIER_THRESHOLDS
│ │ │ ├── risk.py # Severity/Category enums, Location, RiskScore
│ │ │ ├── suppression.py # Suppression/ignore model
│ │ │ └── tool.py # ToolDefinition, PermissionType
│ │ ├── cli/
│ │ │ ├── main.py # @click group
│ │ │ ├── commands/
│ │ │ │ ├── scan.py # Main scan orchestration
│ │ │ │ ├── inspect.py # Live MCP inspection
│ │ │ │ └── init.py # Config init
│ │ │ └── formatters/
│ │ │ ├── terminal.py # Rich terminal output + calculate_risk_score()
│ │ │ ├── json.py # JSON output
│ │ │ └── sarif.py # SARIF v2.1.0 output
│ │ ├── profiles/
│ │ │ └── defi/ # DeFi profile (AGENT-090 to AGENT-109)
│ │ │ ├── rules.py
│ │ │ ├── scanners/ # solidity, js_ts, defi_secret, agent_payment
│ │ │ ├── analysis/ # llm_analyzer, rpc_analyzer, defi_taint
│ │ │ └── constants/ # defi_protocols, web3_apis, rpc_endpoints
│ │ ├── config/
│ │ │ └── ignore.py # .agent-audit.yaml loader
│ │ ├── utils/
│ │ │ ├── mcp_client.py
│ │ │ └── compat.py
│ │ └── parsers/
│ │ └── treesitter_parser.py
│ ├── tests/ # 1,929 collected (1,924 pass, 1 red by design, 4 skipped)
│ │ ├── test_agent004_semantic.py
│ │ ├── test_expanded_rules.py
│ │ ├── test_privilege_rules.py
│ │ ├── test_defi_profile.py
│ │ ├── test_go_scanner.py
│ │ ├── test_analysis/ # 17 analyzer test modules
│ │ ├── test_cli/ # 5 CLI test modules
│ │ ├── test_formatters/ # 4 formatter test modules
│ │ ├── test_config/ # 3 config test modules
│ │ ├── fixtures/ # Test fixture code
│ │ ├── benchmark/ # Layer 2 benchmark (91 projects)
│ │ ├── ground_truth/ # AVB oracle baseline
│ │ └── e2e/ # End-to-end tests
│ └── pyproject.toml # Poetry config, version = "0.18.2"
├── rules/builtin/ # Monorepo YAML rules (sync to packages/audit before publish)
│ ├── owasp_agentic_v2.yaml
│ ├── owasp_agentic.yaml
│ ├── asi_coverage_v030.yaml
│ ├── mcp_security_v030.yaml
│ └── langchain_security_v030.yaml
├── docs/
│ ├── RULES.md # Rule documentation
│ └── reports/ # Published scan reports
├── CHANGELOG.md
├── README.md / README_CN.md
└── CONTRIBUTING.md
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +156 tokens per session 9bd1163987da
- 1mo ago First seen · 208 lines · 3,386 tokens per session scan A 5a94e148e0a8
agent-audit CLAUDE.md is an instructions file published in the GitHub repository HeadyZhang/agent-audit (241 stars, last pushed 1mo ago), licensed MIT. It adds 3,542 tokens to every session, about $0.0142 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
deno copilot-instructions.md
Copilot instructions for denoland/deno, covering deno development guide for github copilot, network access, high level overview, key directories and key files to understand first.