Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/loocor/codmate/agents-mdgit clone --depth 1 https://github.com/loocor/codmateWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.05081 | $0.05081 |
| Opus 5 | $0.02540 | $0.02540 |
| Sonnet 5 | $0.01016 | $0.01016 |
| Haiku 4.5 | $0.00508 | $0.00508 |
Grade B, and why
codmate AGENTS.md scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- Provider tab includes a Model List setting with Default/Opus/Sonnet/Haiku mappings (edited via the mapping sheet); mappings write to Claude env keys in `~/.claude/settings.json`. How it starts
The opening of the file, as written. The whole thing — 236 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CodMate – AGENTS Guidelines
Purpose
- This document tells AI/code agents how to work inside the CodMate repository (macOS desktop GUI for Codex session management).
- Scope: applies to the entire repo. Prefer macOS SwiftUI/AppKit APIs; avoid iOS‑only placements or components.
Architecture
- App type: macOS SwiftUI app (min macOS 13.5). SwiftPM-only build (no Xcode project).
- Layering (MVVM):
- Models: pure data structures (SessionSummary, SessionEvent, DateDimension, SessionLoadScope, …)
- Services: IO and side effects (SessionIndexer, SessionCacheStore, SessionActions, SessionTimelineLoader, LLMClient)
- ViewModels: async orchestration, filtering, state (SessionListViewModel)
- Views: SwiftUI views only (no business logic)
UI Rules (macOS specific)
- Use macOS SwiftUI and AppKit bridges; do NOT use iOS‑only placements such as
.navigationBarTrailing. - Settings uses macOS 15's new TabView API (
Tab("…", systemImage: "…")) when available; provide a macOS 13.5/14 fallback withtabItem+tag. Container padding is unified (horizontal 16pt, top 16pt).- Tab content uniformly uses
SettingsTabContentcontainer (top-aligned, overall 8pt padding) to ensure consistent layout and spacing across pages.
- Tab content uniformly uses
- Notifications is a top-level Settings page between Terminal and Providers; sections are Common, Codex, Claude Code, and Gemini CLI. Common toggles commit message, title/comment, and copy New/Resume command notifications.
- Providers has been separated from the Codex tab into a top-level Settings page: Settings › Providers manages API key providers, OAuth providers, and Codex/Claude bindings; Settings › Codex only retains Runtime/Privacy/Raw Config (notifications live in Settings › Notifications).
- OAuth providers (Codex/Claude/Gemini/Antigravity/Qwen) are added from the Providers “Add” menu and appear under an OAuth list section with login status and info actions.
- CLI Proxy API status, reroute, and public access live under Providers as shared capabilities; deep diagnostics and installation details live under Settings › Advanced › CLI Proxy API.
- Built-in providers are auto-loaded from an app-bundled
payload/providers.json(managedByCodMate=true). This avoids hardcoding and lets users simply provide API keys; base URLs/models come pre-filled. The list merges bundled entries with~/.codmate/providers.json(user overrides win). - Schema note: use a single provider-level
envKey(preferred) for both Codex and Claude Code connectors. Connector-levelenvKeyremains tolerated for backward compatibility but is considered deprecated and will be ignored at save time to avoid duplication.
- Extensions page (aligned with Providers style):
- Settings › Extensions replaces the old MCP Server page (icon: puzzlepiece.extension).
- Tab 1: MCP Servers (existing list/editor/Uni‑Import UI kept as-is inside the tab); add an Import button to scan Home MCP configs into CodMate.
- Tab 2: Skills (left list + right details split; Add menu supports folder/zip/URL; auto‑sync on changes); add an Import button to scan Home skills into CodMate.
- Commands tab includes Add and Import buttons (Import scans Home command folders into CodMate).
- Import sheets show a vertical list; each row has a right‑aligned strategy control (Skip/Overwrite/Rename) and a context menu “Open in…” to review source files.
- MCP Servers tab keeps: enable toggle on left, edit on right, fixed "Add" button, Uni‑Import preview and confirmation.
- Advanced capabilities (MCPMate download and instructions) remain as a footer/section in MCP Servers tab.
- Search: prefer a toolbar
SearchFieldin macOS, not.searchablewhen exact placement (far right) matters. - Toolbars: place refresh as the last ToolbarItem to pin it at the far right. Keep destructive actions in the detail pane, not in the main toolbar. Command+R and the refresh button also invalidate and recompute global sidebar statistics (projects/path tree and calendar day counts) to reflect new sessions immediately.
- Menu Bar (status item): keep it lightweight with status + quick actions. Show provider/model/sandbox/approval, New/Resume/Search/Open, Recent Projects/Sessions (max 5), Usage summary, Provider switch, Settings/Quit; avoid destructive actions.
- Sidebar (left):
- Top (fixed): "All Sessions" row showing total count and selection state.
- Middle (scrollable): path tree built from
cwdcounts. Rows are compact: default min row height 18, small control size, reduced insets. Single-click selects/expands; double-click applies filter (enter the directory). - Projects mode mirrors the compact list style; Cmd-click toggles multi-selection so users can filter sessions by several projects simultaneously (descendants remain included).
- Bottom (fixed): calendar month view (240pt height) with per-day counts (created/last-updated switch). Always pinned to the bottom with 8pt spacing above. Supports multi-select via Command-click to toggle multiple days; plain click selects a single day (click the same day to clear).
- Only the middle path tree scrolls; top "All Sessions" and bottom calendar remain fixed.
- Sidebar width: min 220pt, max 25% of window width, ideal 260pt.
- Content (middle):
- Default scope loads “today” only for speed.
- Sorting picker is left‑aligned with list content.
- Each row shows: title, timestamps/duration, snippet, and compact metrics (user/assistant/tool/reasoning).
- Status bar (bottom console):
- Docked console bar spans the right-side area (list + detail); sidebar stays full height.
- Resizable via a drag handle; single-line header collapses/expands to multi-line log history.
- Auto mode collapses when idle (no interaction); View menu supports Always Show/Hide.
- Detail (right):
- Sticky action bar at top: Resume, Reveal in Finder, Delete, Export Markdown.
- Add “New” button next to Resume to start a fresh Codex session using the current session’s working directory and model.
- When an embedded terminal is running, show a “Prompts” button beside the folder (Reveal in Finder) icon. Clicking opens a searchable popover of preset command texts; selecting one inserts it into the embedded terminal input (does not auto-execute). User presses Return to run.
- Project-level Extensions are configured in Edit Project: tabs are General, Profile, MCP Servers, Skills (auto‑sync; Gemini project-level toggles disabled). MCP Servers/Skills tabs include Import buttons that scan the project directory. Edit Project window should be resizable.
- Review mode: the list.bullet.rectangle button toggles a full-area Review view (third mode, alongside Conversation and Internal Terminal). In Review mode the detail area is fully occupied by a Git Changes surface. It:
- Auto-detects the Git repo at the session’s working directory (uses
/usr/bin/env gitand a robust PATH). - Lists changed files with stage/unstage toggles and shows a unified diff or a raw file preview (updates on save). Preview is text-only in phase 1.
- Provides a commit box. In full-area mode it uses a multi-line editor with more space.
- Repository authorization is on-demand: when opening Review, the app resolves the repository root (the folder containing
.git) and, if needed, prompts the user with an NSOpenPanel to authorize that folder via a security-scoped bookmark. The Settings page no longer lists authorized repositories; authorization and revoke are managed inline in the Review header.
- Auto-detects the Git repo at the session’s working directory (uses
- “Task Instructions” uses a DisclosureGroup; load lazily when expanded.
- Conversation timeline uses LazyVStack; differentiate user/assistant/tool/info bubbles.
- Timeline & Markdown visibility: Settings › General provides per-surface checkboxes to choose which message types are shown in the conversation timeline and included when exporting Markdown. Defaults: Timeline shows User, Assistant, Reasoning, and Code Edit; Tool Invocation, Token Usage, and Other Info are off by default. Markdown includes only User and Assistant. Environment Context and Turn Context are surfaced in dedicated sections and not configurable; Task Instructions remain in the detail DisclosureGroup; Ghost Snapshot is ignored. Code edits are surfaced as their own message type (extracted from tool calls) and have a separate toggle.
- Turn Context is surfaced in the Environment Context card and is not exposed as a separate toggle or timeline item.
- Context menu in list rows adds: “Generate Title & 100-char Summary” to run LLM on-demand for the selected session.
- Embedded Terminal: One live shell per session when resumed in-app; switching sessions in the middle list switches the attached terminal. The shell keeps running when you navigate away. “Return to history” closes the running shell for the focused session.
- Prompt picker: When embedded terminal is running, a Prompts button opens a searchable list. Prompts are merged from per-project
.codmate/prompts.json(if present) and~/.codmate/prompts.json(user), de-duplicated by command, then layered with a few built‑ins. Items accept either{ "label": "…", "command": "…" }or a plain string (used for both). Selection inserts into the terminal input without executing. The header wrench button opens the preferred file (project if exists, else user). Typing a new command shows “Add …” to create a prompt in the preferred file. Deleting a built‑in prompt records it in a hidden list (prompts-hidden.jsonat project if project prompts exist, else at user), which suppresses that built‑in in the UI. - Terminal shortcuts: (none for now). Clearing via shortcut is not implemented.
- Prompt picker: When embedded terminal is running, a Prompts button opens a searchable list. Prompts are merged from per-project
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 236 lines · 5,081 tokens per session scan B 3f4cb20d6adf
codmate AGENTS.md is an instructions file published in the GitHub repository loocor/codmate (667 stars, last pushed 5mo ago), licensed Apache-2.0. It adds 5,081 tokens to every session, about $0.0254 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
obsidian-mind CLAUDE.md
Claude Code instructions for breferrari/obsidian-mind, covering obsidian mind, skills & capabilities, custom slash commands, vault structure and obsidian cli.
obsidian-mind AGENTS.md
AGENTS.md instructions for breferrari/obsidian-mind, covering obsidian mind, hooks, commands, memory and reaching this vault from another repo.
parallel-code CLAUDE.md
Instructions for johannesjo/parallel-code, covering parallel code, stack, commands, project structure and conventions.
skills-manager CLAUDE.md
Instructions for yibie/skills-manager, covering skills manager - development guide, tui engine: blessed, 核心原则, 参考文档 and 正确的 list 用法.
neo4j-skills AGENTS.md
Instructions for neo4j-contrib/neo4j-skills, covering writing skills for this repository, language style — write for agents, not humans, six design principles, skill.md spec (agentskills.io) and frontmatter.
swift-tui AGENTS.md
Instructions for SwiftTUI/swift-tui, covering agents.md, build & test commands, architecture (one-page summary), development guidelines and code style.