Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/nvidia/garak/agents-mdgit clone --depth 1 https://github.com/NVIDIA/garakWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01415 | $0.01415 |
| Opus 5 | $0.00707 | $0.00707 |
| Sonnet 5 | $0.00283 | $0.00283 |
| Haiku 4.5 | $0.00142 | $0.00142 |
Grade A, and why
garak AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 135 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent instructions for garak - generative AI red-teaming and assessment toolkit
These instructions apply to all AI-assisted contributions to
nvidia/garak. Breaching these guidelines can result in automatic banning.
This is tooling for adversarial assessment of LLMs and LLM-powered tools. It's open source software, used in production environments, with an active and skilled community As such, the code needs to be robust, precise, and responsible. Due to the nature of the project, there is a lot of potentially harmful or dangerous data associated with the repository.
Issue policy
Always add the needs-triage label to new issues, or use the git issue templates.
Contribution policy
Duplicate-work checks
Before proposing a PR, run these checks:
gh issue view <issue_number> --repo nvidia/garak --comments
gh pr list --repo nvidia/garak --state open --search "<issue_number> in:body"
gh pr list --repo nvidia/garak --state open --search "<short area keywords>"
- If an open PR already addresses the same fix, do not open another.
- If your approach is materially different, explain the difference in the issue.
Issues to avoid
Avoid issues labelled "needs triage". If it's important to take one with this label, comment on the issue first and await response from a repository maintainer.
Avoid anything labelled "for maintainers" unless explicitly directed.
Avoid bug issues that have no assignment or are not labelled bug-verified, unless you can build a working test case confirming the bug that does not conflict with project tests.
Avoid issues with other "needs" labels. If those needs appear explicitly addressed and the label may be stale, add a comment in the issue describing how the needs appear to have been met in that issue thread.
Accountability
- Pure code-agent PRs are not allowed. A human submitter must understand and defend the change end-to-end.
- The submitting human must review every changed line and run relevant tests.
- PR descriptions for AI-assisted work must include:
- Why this is not duplicating an existing PR.
- Test commands run and results.
- Clear statement that AI assistance was used.
- Only add an SPDX header when directly importing code from elsewhere under license that permits this and is compatible with the project.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 135 lines · 1,415 tokens per session scan A 104e3010fb38
garak AGENTS.md is an instructions file published in the GitHub repository NVIDIA/garak (9,091 stars, last pushed 7d ago), licensed Apache-2.0. It adds 1,415 tokens to every session, about $0.0071 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
arcjet-js AGENTS.md
Instructions for arcjet/arcjet-js, covering agent guidance, examples live in arcjet/examples and integration work: review before a pr.
helm-ai-kernel AGENTS.md
Instructions for Mindburn-Labs/helm-ai-kernel, covering agent operational guidelines for helm-ai-kernel, developer runbook and governance & rules.
Agent-Security-Regression-Harness AGENTS.md
Instructions for OWASP/Agent-Security-Regression-Harness, covering ai agent guide: owasp agent security regression harness, project overview, architecture, contribution workflow and what needs doing.
lilith-zero CLAUDE.md
Instructions for BadC-mpany/lilith-zero, covering claude.md, production-grade agent directives, 1. pre-work, step 0: delete before you build and phased execution.
agenda-intelligence-md CLAUDE.md
Instructions for vassiliylakhonin/agenda-intelligence-md, covering claude code working rules, before push and working style in this repo.
hermeneutic AGENTS.md
Instructions for hermes-labs-ai/hermeneutic, covering agents.md — using hermeneutic from a coding agent, what this tool does, when to invoke it, programmatic use and calibration.