Borrowing it
Nothing to install: this file belongs to PriNova/graphone. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/PriNova/graphone/main/AGENTS.mdgit clone --depth 1 https://github.com/PriNova/graphoneWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/prinova/graphone/agents-md)<a href="https://agentmods.dev/instructions/prinova/graphone/agents-md"><img src="https://agentmods.dev/badge/instructions/prinova/graphone/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/prinova/graphone/agents-md"><img src="https://agentmods.dev/badge/instructions/prinova/graphone/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.02832 | $0.02832 |
| Opus 5.5 | $0.01133 | $0.01133 |
| Sonnet 5.5 | $0.00566 | $0.00566 |
| Haiku 4.5 | $0.00283 | $0.00283 |
Grade D, and why
graphone AGENTS.md scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
| `makensis.exe: No such file` | `sudo apt install nsis` or use `build:windows:exe` | Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
- Requires **bun**: `curl -fsSL https://bun.sh/install | bash` Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Requires **bun**: `curl -fsSL https://bun.sh/install | bash` How it starts
The opening of the file, as written. The whole thing — 217 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Graphone - Agent Quick Reference
Agent Workflow Guidelines
- Check local code first - Before using GitHub tools (
read_github,search_github, etc.), always explore the local codebase using standard file tools (read,bashwithfind/grep, etc.) - Check pi-mono first for feature implementations - Since graphone is a visual wrapper around pi-mono, look up implementations in local
../pi-monofirst (when available). Many features already exist there and can be mimicked or adapted for desktop UI - Use GitHub tools only when you need to reference external repositories or when explicitly asked about remote code
- Do not track or push
docs/changes - Thedocs/folder and all files under it are local-only in this repo context. Do notgit add/commit/push anything indocs/(including withgit add -f) unless the user explicitly overrides this rule in the current task. - Use title + body commit messages by default - Unless the user explicitly requests otherwise, write commits with a concise title and a descriptive body (not title-only).
- Use robust multiline commit messages - Do not embed literal
\nin a singlegit commit -mstring. Use multiple-mflags (one per paragraph) orgit commit -Fwith a heredoc/file so line breaks render correctly on GitHub. - PAT push hygiene - If pushing with
GITHUB_PAT, pass it via git auth headers/env only; never echo, print, or otherwise expose the token in commands/output. - Default autonomous iteration guidance - For general coding-agent-first execution patterns (tests, TDD/debug loops, logs, traces, artifacts, contracts, smokes, escalation), see
docs/agent-first-autonomous-iteration-playbook.md - Visual verification uses readiness loops, not fixed sleeps - Follow the global workflow
bash -> readiness loop -> take_screenshot -> bash cleanup. The readiness wait must happen inside the startupbashcall because screenshot tools cannot run until that tool call returns. - Do not start and stop dev helpers in parallel - Startup and cleanup are separate sequential tool calls, with
take_screenshotbetween them. Runningstart-dev-and-wait.shandstop-dev.shin parallel is invalid and defeats the workflow. - Prefer project helper scripts for visual checks - For Graphone, use
tooling/scripts/start-dev-and-wait.shandtooling/scripts/stop-dev.shinstead of rewriting startup/cleanup loops inline.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 217 lines · 2,832 tokens per session scan D b49a4f9127be
graphone AGENTS.md is an instructions file published in the GitHub repository PriNova/graphone (90 stars, last pushed 4mo ago), licensed MIT. It adds 2,832 tokens to every session, about $0.0113 per session on Opus 5.5. A static security scan graded it D with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
graphone AGENTS.md compared with instructions from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| graphone AGENTS.mdPriNova/graphone | Instructions file | 90 | 4mo ago | MIT | D | 2,832 | Codex, OpenCode |
| vscode buildNext.instructions.mdmicrosoft/vscode | Instructions file | 195k | yesterday | MIT | A | 9,719 | GitHub Copilot |
| next.js AGENTS.mdvercel/next.js | Instructions file | 143k | yesterday | MIT | A | 7,461 | Codex, OpenCode |
| langchain AGENTS.mdlangchain-ai/langchain | Instructions file | 149k | yesterday | MIT | A | 4,680 | Codex, OpenCode |
| vscode oss-third-party-notices.instructions.mdmicrosoft/vscode | Instructions file | 195k | yesterday | MIT | A | 5,516 | GitHub Copilot |
| vscode copilot-instructions.mdmicrosoft/vscode | Instructions file | 195k | yesterday | MIT | A | 3,093 | GitHub Copilot |
| deepseek-harness AGENTS.mddeepseek-ai/deepseek-harness | Instructions file | 274k | 2d ago | MIT | A | 4,313 | Codex, OpenCode |