agentmods.dev

arc AGENTS.md

An AGENTS.md instruction file for the Arc project, which is a plugin that guides work from an idea through shipped code. It defines the available commands, workflow order, and where their behaviour should live.

In plain words
What is it for?
Using Arc's ideation, review, implementation, testing, audit, improvement, refactoring, commit, release, launch, and vision workflows.
Why use it?
It helps agents follow Arc's intended process and avoid duplicating or changing behaviour in the wrong file.

Instructions file for CodexOpenCode

25 17d ago A scan 1,113 tokens original MIT
View the source file howells/arc
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/howells/arc/agents-md
Clone the repo
git clone --depth 1 https://github.com/howells/arc

Made for: Codex, OpenCode.

Per session 1,113 This file is loaded in full into every session.
When invoked 1,113 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01113 $0.01113
Opus 5 $0.00557 $0.00557
Sonnet 5 $0.00223 $0.00223
Haiku 4.5 $0.00111 $0.00111

Measured yesterday against content hash 672cf26fd5d6, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

arc AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 49 lines

How it starts

The opening of the file, as written. The whole thing — 49 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Arc

The full arc from idea to shipped code, shipped as a plugin for Claude Code, Codex, and Cursor. CONTEXT.md is the canonical product definition, domain language, and operating boundary - read it before changing workflow behaviour. Treat this file as contributor guidance, not a competing definition.

Shape

  • Each skill in skills/<name>/SKILL.md is one /arc:<name> command, routed by a thin commands/<name>.md. Never fork behaviour between the two.
  • Commands: /arc:ideate, /arc:review, /arc:implement, /arc:testing, /arc:audit, /arc:improve, /arc:refactor, /arc:commit, /arc:release, /arc:launch, /arc:vision.
  • Canonical flow is ideate -> (review) -> implement. audit, improve, commit, release, and refactor are cross-cutting and available anytime.
  • Skills draw on agents/ (subagents), references/ (domain knowledge, catalogued in references/index.md), rules/, disciplines/ (methodologies), and templates/ (output structures).
  • skills/using-arc/ is the session control plane; skills/detail/ is internal to implement. Neither has a command router.
  • Site work is isolated under site/ with its own Next.js scripts.
  • rules/ is Arc's internal corpus, loaded selectively by workflows. It's shipped in the plugin payload but never injected as always-on Cursor rules - tests/test-cursor-plugin.sh enforces that.

Gotchas

  • Rebuild the Codex mirror after any change to skills/, agents/, references/, rules/, disciplines/, templates/, scripts/, or commands/. Run pnpm build:codex. The pre-commit hook and tests/test-codex-mirror.sh both fail on a stale mirror, and the failure names the diffing file rather than the real cause.
  • plugins/arc/ is generated. Never edit it by hand - scripts/build-codex-plugin.sh overwrites it wholesale.
  • Version bumps touch five manifests. Use bash scripts/bump-version.sh <version>, never a manual edit: it updates package.json, .claude-plugin/, .codex-plugin/, .cursor-plugin/ (plugin and marketplace), and the generated plugins/arc/.codex-plugin/. Verify with bash scripts/bump-version.sh --check. A post-commit hook auto-bumps the patch version and amends content commits.
  • Adding a skill needs more than a SKILL.md. It also needs a commands/<name>.md router, a .agents/skills/<name> symlink, and entries in the plugin manifests - tests/test-skill-loading.sh hardcodes the expected skill list and fails on any unexpected directory.
  • Agents are not skills. Every file in agents/*/*.md keeps its own <arc_runtime> and unconditionally loads references/subagent-safety.md. That's deliberate: agents are dispatched as subagents and skip using-arc via its <SUBAGENT-STOP> block, so those local blocks are their only path grounding and injection defence. tests/test-xml-tags.sh enforces tag containment for agents but not for skills, for the same reason.
  • Skills must stay self-sufficient. audit, improve, and refactor carry context: fork and run isolated; command routers also invoke skills cold. Don't centralise a skill's <arc_runtime> into using-arc - path resolution would silently break.
  • Adding a required reference to a skill means the file must exist and the skill must say when to read it. tests/test-agents-and-refs.sh checks the first half.

Read the full file on GitHub · 49 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 49 lines · 1,113 tokens per session scan A 672cf26fd5d6

Subscribe to this mod's changes

arc AGENTS.md is an instructions file published in the GitHub repository howells/arc (25 stars, last pushed 17d ago), licensed MIT. It adds 1,113 tokens to every session, about $0.0056 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Code reviewGit and workflowTestingWorkflowsai-agentsclaude-codecodexdeveloper-toolstdd
Related

Other instructions, from other repositories

agents AGENTS.md

Instructions for cloudflare/agents, covering agents.md, project overview, repository structure, nested agents.md files and setup.

cloudflare/agents · 2,131 tokens

heym CLAUDE.md

Claude Code instructions for heymrun/heym, covering claude.md - combative directive ⚠️, 1. mandatory: load agents.md immediately ⚠️, 2. my ironclad rules, 3. session startup protocol and 4. alert system.

heymrun/heym · 253 tokens

gem-team AGENTS.md

Instructions for mubaidr/gem-team, covering agents.md, project overview, key features, setup commands and install apm (agent package manager).

mubaidr/gem-team · 1,442 tokens

Codex-Workflows AGENTS.md

Instructions for robzilla1738/Codex-Workflows, covering agent instructions, project shape, commands, distribution rules and runtime rules.

robzilla1738/Codex-Workflows · 524 tokens

specs-driven-development-spring-angular frontend-code.instructions.md

Frontend code guardrails for Angular implementation, testing, and accessibility.

loiane/specs-driven-development-spring-angular · 255 tokens

engineering-skills CLAUDE.md

Instructions for int2t05/engineering-skills, covering claude.md, conventions and skill discovery.

int2t05/engineering-skills · 446 tokens