Borrowing it
Nothing to install: this file belongs to ImYourBoyRoy/Portable_Web_toolkit. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ImYourBoyRoy/Portable_Web_toolkit/main/AGENTS.mdgit clone --depth 1 https://github.com/ImYourBoyRoy/Portable_Web_toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/imyourboyroy/portable_web_toolkit/agents-md)<a href="https://agentmods.dev/instructions/imyourboyroy/portable_web_toolkit/agents-md"><img src="https://agentmods.dev/badge/instructions/imyourboyroy/portable_web_toolkit/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/imyourboyroy/portable_web_toolkit/agents-md"><img src="https://agentmods.dev/badge/instructions/imyourboyroy/portable_web_toolkit/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01380 | $0.01380 |
| Opus 5.5 | $0.00552 | $0.00552 |
| Sonnet 5.5 | $0.00276 | $0.00276 |
| Haiku 4.5 | $0.00138 | $0.00138 |
Grade C, and why
Portable_Web_toolkit AGENTS.md scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Instruction-override phrasinghighPrompt injection
Text telling the model to disregard its earlier instructions or safety rules is the shape of a prompt injection, whoever wrote it.
None of these override safety policy or explicit repository constraints. How it starts
The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Portable Web Toolkit — Agent Instructions
Blind agents: read START_HERE.md first — zero research required.
Repo-local rules for AI agents using the Portable Astro + Cloudflare Web Toolkit (Web_Toolkit/).
Read first (in order)
- The active client repository's applicable instructions when operating on a client site
START_HERE.mdfor toolkit orientation- The narrow installed skill in
skills/ Web_Toolkit/OPERATIONS.mdonly when detailed operations are relevant- Current source, manifests, profiles, tests, and runtime evidence
Do not load docs/templates/AGENT.template.md for toolkit work — that template is for other projects.
Toolkit root
All operator modules live under:
Web_Toolkit/
Site-specific behavior comes from site-profiles/*.json (or a private profile path passed with --site-profile). Live secrets belong in the target project root .env, not in the toolkit tree.
Authority and precedence
Follow the host's actual system, administrator, user, repository, and nested instruction precedence.
When operating on a client site:
- client-repository instructions and approved runbooks govern that site
- current source, manifests, tests, and runtime evidence establish state
- Portable Web Toolkit skills supply subordinate domain procedures
- toolkit documentation supplies conditional reference material
This file governs work on the toolkit repository itself. It does not outrank a
client repository merely because Web_Toolkit is linked into that project.
Configuration has scoped authority, not instruction precedence:
- a site profile owns its declared deployment configuration
- a Brand Guide owns approved visual identity and voice
.envsupplies local values and bindings- manifests and lockfiles own package state
None of these override safety policy or explicit repository constraints.
Core rules
- Spec-driven: read the site profile before deploy, DNS, or branding changes.
- Dry-run first: infrastructure and Cloudflare mutations → audit → dry-run →
--apply. - Runtime artifacts: keep generated output in
Web_Toolkit/.runtime/, not in publishable source. - Discovery layer: use the established toolkit generators and
discovery-doctorwhen the client repository adopts that contract. Do not create a parallel generator. - Styles: external CSS in
src/styles/with tokens; runstylesheet-check scan --root <project>when changing UI CSS. - Accessibility: toolkit sites use bundled
Web_Toolkit/wcag_auditoronly — never resolveAI/wcag-auditoror other trees outside the linked toolkit. Evidence gate — not a conformance certificate. - Assets: no stock/placeholder favicons or heroes; Astro
Image/Picture(astro:assets,imageService: 'compile'on Workers) for content photos — preferOptimizedPicturewith AVIF+WebP. image-pipeline only for leftoverpublic/rasters. SVG masters for icons/logos. - Workers-over-external: prefer Cloudflare Workers/bindings (KV, D1, R2, Vectorize) before adding SaaS.
- Version truth: verify Astro/Wrangler/Node from repo + registry — never trust stale model memory.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 127 lines · 1,380 tokens per session scan C 491fe2ca88a8
Portable_Web_toolkit AGENTS.md is an instructions file published in the GitHub repository ImYourBoyRoy/Portable_Web_toolkit (2 stars, last pushed 2mo ago), licensed MIT. It adds 1,380 tokens to every session, about $0.0055 per session on Opus 5.5. A static security scan graded it C with 1 finding (instruction-override phrasing). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
deepseek-harness AGENTS.md
AGENTS.md instructions for deepseek-ai/deepseek-harness, covering agents.md, pre-stable apis and released session data, repository layout, commands and host sandbox failures.