Borrowing it
Nothing to install: this file belongs to hxy91819/mason-skills. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/hxy91819/mason-skills/main/AGENTS.mdgit clone --depth 1 https://github.com/hxy91819/mason-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/hxy91819/mason-skills/agents-md)<a href="https://agentmods.dev/instructions/hxy91819/mason-skills/agents-md"><img src="https://agentmods.dev/badge/instructions/hxy91819/mason-skills/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/hxy91819/mason-skills/agents-md"><img src="https://agentmods.dev/badge/instructions/hxy91819/mason-skills/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.02283 | $0.02283 |
| Opus 5 | $0.01141 | $0.01141 |
| Sonnet 5 | $0.00457 | $0.00457 |
| Haiku 4.5 | $0.00228 | $0.00228 |
Grade A, and why
mason-skills AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Repository Agent Rules
Skill invocation policy
每当创建、迁移或修改一个 skill，交付前必须先判断它的默认触发类型，并把判断结果告知用户。
分类与默认值
先阅读该 skill 的 SKILL.md，以及已有的 agents/openai.yaml（如果存在），再按主要使用方式分类：
- 流程类 skill：负责规划、审查、复盘、治理、发布、迁移、编排，或包含审批门禁、用户决策或明显副作用的多步流程。默认仅显式触发，设置
policy.allow_implicit_invocation: false；用户需要通过$skill-name调用。它不会被隐式注入 Codex context。 - 被动型 skill：提供可在请求自然匹配时由 agent 主动采用的通用能力，通常是低风险的格式化、生成、查询或验证。默认允许隐式触发，设置
policy.allow_implicit_invocation: true。 - 无法明确分类或两者混合：采用流程类的保守默认值
false，并向用户说明不确定性和可选覆盖方式，不得静默选择。
分类依据是 skill 的实际工作流和风险，不是目录名称。可参考仓库现有设置：anti-ai-slop、distill、autoreview、large-task-planning、use-worktree、story-direction-review 和 ask-oracle 为显式触发；open-source-contribution 为允许隐式触发。
仓库存在两种触发标记：Codex 优先读取 agents/openai.yaml 的 policy.allow_implicit_invocation；部分兼容旧技能还在 SKILL.md frontmatter 使用 disable-model-invocation: true。流程类 skill 必须以 allow_implicit_invocation: false 为 Codex 默认值，并保留或同步已有的 disable-model-invocation: true；被动型 skill 不得遗留与允许隐式触发相冲突的禁用标记。
配置与告知机制
- 在
agents/openai.yaml中写入或更新policy.allow_implicit_invocation，保留无关的interface与dependencies字段；缺少该文件时创建最小完整配置。 - 让
SKILL.md的描述和正文与该策略一致：显式触发的 skill 要说明需要用户调用，允许隐式触发的 skill 不得声称只能手动调用。description只写何时触发，不介绍 skill 做什么；行为变化写进正文，默认不动description。 - 向用户报告：skill 名称、分类、默认策略、判断依据、配置文件，以及显式触发时的
$skill-name用法；若采用保守默认，还要说明如何请求改为允许隐式触发。 - 用 skill validator、YAML 解析和
git diff --check验证；若配置或分类与用户明确要求冲突，以用户要求为准并在报告中说明。
Skill 清单维护
config/skill-symlinks.yaml 是本仓库推荐 user-scope 软链的单一事实源：记录哪些 skill 推荐软链到全局（~/.agents/skills）。外部项目（如 mattpocock-skills）经 sources: 按项目名登记，条目加 source: 指向项目；项目位置按 $SKILL_SOURCE_<NAME>_DIR > $SKILL_SOURCES_DIR/<项目名> > 本仓库同级目录解析，清单里绝不写机器绝对路径。其他电脑拉取本仓库后，依据它即可复现同一套 skill 配置，无需口口相传。
- 在
common-skills/新增 skill 且用户要求软链到 user scope 时，必须同步登记清单：python3 common-skills/skill-manifest-sync/scripts/sync_skill_symlinks.py --mode register --skill <name> [--note "..."] - 登记外部项目 skill 用
--mode register --source <项目名> --skill <name>；项目须已在sources:声明（缺省自动补一条）。 - 删除或重命名 skill 时用
--mode remove --skill <name>同步清单，避免留下悬空条目。 - 交付涉及 skill 增删的改动前，跑一次
--mode check确认清单与本机实际软链一致。 - 本机同步入口是
$skill-manifest-sync：--mode check预览、--mode apply执行。apply 对「指向本仓库或已声明来源项目但不在清单里」的软链逐个提示删除；用户明确说保留时写入本机白名单~/.agents/skill-sync-whitelist.yaml。白名单属于本机环境偏好，不提交 Git，也不得加进仓库的.gitignore之外的任何清单文件。 - 脚本只管理直接指向本仓库或已声明来源项目的软链：真实目录和经其他工作区中转的链接一律不碰，冲突只报告。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +47 tokens per session ab3d4ca48095
- yesterday Changed · +7 tokens per session c2e21aec7036
- 4d ago Changed · +1 lines · +128 tokens per session 062952f8a058
- 5d ago Changed · +29 tokens per session b5b5702037ae
- 6d ago Changed · +43 lines · +1,262 tokens per session 17de8928f629
- 10d ago First seen · 31 lines · 810 tokens per session scan A 449bd8e1e19c
mason-skills AGENTS.md is an instructions file published in the GitHub repository hxy91819/mason-skills (2 stars, last pushed today), licensed MIT. It adds 2,283 tokens to every session, about $0.0114 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
spec-kit AGENTS.md
AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.