dotsweep AGENTS.md

Instructions for maintaining the published dotsweep agent skill and its mirrored repository files, including rules about which copy is the source.

In plain words
What is it for?
It guides edits in the engine repository, synchronization with the mirror, keeping required files identical, and checking the packaged skill before publication.
Why use it?
It prevents the published skill, repository copies, and installation paths from drifting apart or serving different instructions.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/stanmaygo/dotsweep/agents-md
Clone the repo
git clone --depth 1 https://github.com/stanmaygo/dotsweep

Made for: Codex, OpenCode.

Per session 640 This file is loaded in full into every session.
When invoked 640 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00640 $0.00640
Opus 5 $0.00320 $0.00320
Sonnet 5 $0.00128 $0.00128
Haiku 4.5 $0.00064 $0.00064

Measured 2d ago against content hash 0583501c77f1, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

dotsweep AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

1 near-identical copy found in the catalogue:

AGENTS.md · 52 lines

How it starts

The opening of the file, as written. The whole thing — 52 lines — stays where its author put it; the contents beside it link to each section on GitHub.

dotsweep-skill

The published agent skill for dotsweep, and its packaging. Nothing else lives here.

AGENTS.md is a byte-identical copy of this file: Codex, Cursor and Warp read that name, Claude Code reads this one, and the validator holds them equal so they are one document rather than two.

This repo is a mirror, not the source

skills/dotsweep/SKILL.md is generated by copying, from the engine repository that also holds the Go CLI and the Cloudflare Worker. Editing it here is how the two come to disagree: the next sync overwrites the change, and the hosted dotsweep.com/skill.md — which is what the paste-one-message install actually fetches — keeps serving the other version. Two installs of the same skill then behave differently with nothing reporting it.

Edit the prompt in the engine repo, then run scripts/sync-skill.sh here.

What must stay true

  • SKILL.md at the root and skills/dotsweep/SKILL.md hold the same bytes. npx skills add reads the root path and a manual installer reads the directory, so both have to be the prompt.

    This was a symlink, and a symlink does not survive publication: raw.githubusercontent.com serves a link's target as the file body, so the published root SKILL.md returned the 24-byte string skills/dotsweep/SKILL.md to anything reading it without a clone — the GitHub UI, a raw URL, a copy-paste install. The invariant was right and the mechanism was wrong. sync-skill.sh writes both copies and the validator compares them, which asserts the thing that actually matters.

  • The version lives in two filesmetadata.version in the skill frontmatter and version in .claude-plugin/plugin.json — and they must move together. marketplace.json deliberately carries none, so plugin.json stays the single source of truth. scripts/bump-version.py carries it across on sync so it is not a step someone has to remember.

  • No machine-specific paths and no API host but dotsweep.com in the prompt. Both were violated once in the commit that added the check for them.

Read the full file on GitHub · 52 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 52 lines · 640 tokens per session scan A 0583501c77f1

Subscribe to this mod's changes

dotsweep AGENTS.md is an instructions file published in the GitHub repository stanmaygo/dotsweep (3 stars, last pushed 1mo ago), licensed MIT. It adds 640 tokens to every session, about $0.0032 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.