Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/suxrobgm/jobpilot/claude-mdgit clone --depth 1 https://github.com/suxrobGM/jobpilotWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00963 | $0.00963 |
| Opus 5 | $0.00481 | $0.00481 |
| Sonnet 5 | $0.00193 | $0.00193 |
| Haiku 4.5 | $0.00096 | $0.00096 |
Grade A, and why
jobpilot CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 63 lines — stays where its author put it; the contents beside it link to each section on GitHub.
JobPilot
Multi-user AI job-application app. The Next.js web UI and the Elysia + PostgreSQL API (owner of
all state) are cloud-hosted and shared across users; each user runs the agent locally - Claude
Code or Codex in a .NET PTY host, plus Playwright - so jobs run on that user's own subscription.
Dev ports: web :4100, API :4101, PTY host :4102.
Auth: on terminal start the web fetches the user's reusable terminal token
(POST /api/auth/tokens/terminal) and hands it to the PTY host, which injects it as
JOBPILOT_API_TOKEN; skills send it as Authorization: Bearer to the API.
Layout
apps/web/- Bun + Next.js 16 + MUI 9 UI; talks to the API over HTTP only (no direct DB). Browser and server hit Elysia directly viaNEXT_PUBLIC_API_URL-src/proxy.tsis Next 16 auth middleware (route gating), not a data proxy.apps/api/- Bun + Elysia + Prisma 7; owns all persistence. Exportstype Appfor Eden Treaty typing; Swagger UI at:4101/swaggerin dev.apps/terminal/- .NET 10 PTY host (JobPilot.Terminal); runs on each user's machine.tests/JobPilot.Terminal.Tests/- .NET test suite for the host (solution:JobPilot.slnx).packages/-@jobpilot/contracts(shared Zod schemas),@jobpilot/api-client(Eden client).plugin/- the JobPilot plugin: one provider-neutral skill tree for Claude and Codex. Edit skills here directly - no generation step.docs/- user-facing docs;deploy/- production stack.
Commands
Root (bun run …):
dev- terminal + api + web together;dev:api/dev:web/dev:terminalrun one.db:tunnel- SSH tunnel to the remote PostgreSQL, bound tolocalhost:5433. The repo ships no database container, soDATABASE_URLpoints at whichever PostgreSQL you supplied - a local one you run yourself or the tunnel. Both conventionally use 5433, so check what is actually on that port (docker ps,lsof -i :5433) before concluding which you are talking to.db:setup- Prisma generate + apply migrations + seed.test- the API suite plus the contracts suite (bun testinapps/apiandpackages/contracts).build:api/build:web/build:terminal- production builds.check/format/lint- Biome repo-wide (check= format + lint + import sort, writes). Biome skips Markdown;.editorconfigcovers whitespace there.ci-biome ci --error-on-warnings .. Warnings must fail the build or the gate is a no-op. Never runbiome check --write --unsafe: thenoNonNullAssertionfix rewritescookie[KEY]!.set(…)to?.set(…), silently dropping auth cookie writes.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 63 lines · 963 tokens per session scan A 488e99fed731
jobpilot CLAUDE.md is an instructions file published in the GitHub repository suxrobGM/jobpilot (60 stars, last pushed 11d ago), licensed MIT. It adds 963 tokens to every session, about $0.0048 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
job-seeker AGENTS.md
Instructions for galiprandi/job-seeker, covering job seeker — rules, gold rules, gold rule 1, gold rule 2 and gold rule 3 — user preferences always up to date.
dear-hiring-manager CLAUDE.md
Instructions for extrasmall0/dear-hiring-manager, covering claude.md — dear-hiring-manager, what this is, architecture principle, layout and user data (never in repo).
give-me-job AGENTS.md
Instructions for kyoungbinkim/give-me-job, covering give-me-job repository instructions, default workflow, skill routing, working on this repository and development loop.
job-search AGENTS.md
Instructions for pedrolucazx/job-search, covering job search agent, where to start, repository conventions and if your agent has no slash commands.
claude-resume-kit CLAUDE.md
Instructions for ARPeeketi/claude-resume-kit, covering claude-resume-kit — project instructions, file map, your role, user focus directives and anti-fabrication rules.
resume-tailor-plugin CLAUDE.md
Instructions for olegvg/resume-tailor-plugin, covering claude.md, project overview, architecture, key concepts and external dependency.