Borrowing it
Nothing to install: this file belongs to ukorvl/web-of-flaws. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ukorvl/web-of-flaws/main/AGENTS.mdgit clone --depth 1 https://github.com/ukorvl/web-of-flawsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/ukorvl/web-of-flaws/agents-md)<a href="https://agentmods.dev/instructions/ukorvl/web-of-flaws/agents-md"><img src="https://agentmods.dev/badge/instructions/ukorvl/web-of-flaws/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/ukorvl/web-of-flaws/agents-md"><img src="https://agentmods.dev/badge/instructions/ukorvl/web-of-flaws/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00868 | $0.00868 |
| Opus 5.5 | $0.00347 | $0.00347 |
| Sonnet 5.5 | $0.00174 | $0.00174 |
| Haiku 4.5 | $0.00087 | $0.00087 |
Grade A, and why
web-of-flaws AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 77 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent Instructions for Web of Flaws
Purpose
Web of Flaws is a machine-readable catalog of vulnerable web patterns and safer replacements. Every rule must help a developer or coding agent understand the security boundary, exploitation conditions, and appropriate remediation.
The goal of the project is to serve both humans and machines. It means, all guides should be written in a way that is understandable by humans, but also structured and formatted in a way that can be parsed and processed by machines.
Technical correctness, clear security reasoning, and machine-readable consistency take priority over brevity or stylistic preference.
Instruction Hierarchy
Read this file first, then read the closest nested AGENTS.md for every directory you modify before you start.
The closest instruction file takes precedence for its subtree and may override or extend the rules in this file.
- Do not duplicate parent rules in nested AGENTS.md files.
- Keep root instructions limited to rules that apply repo-wide.
- If you add a new module consider to add a new AGENTS.md file in that module to define its own rules if it has any specific requirements valuable for code generation.
- If you change repository structure, update the instruction hierarchy accordingly.
- Keep agent instructions in sync with the repository's actual structure and behavior when you make changes.
Stack and Environment
- This is a documentation-first repository with Python tooling for validation, generation, and repository maintenance.
- Python code targets the version declared in
pyproject.toml. - Repository dependency and tool versions are defined by their existing configuration and lockfiles; do not introduce alternative package-management or build systems without an explicit architectural reason.
- Use repository-provided scripts and configuration as the source of truth for validation behavior.
- Do not assume tools are installed globally when the repository defines a reproducible way to invoke them.
- Use paths relative to the repository root unless a local instruction explicitly defines another convention.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +39 lines · +110 tokens per session d9389d463d37
- 1mo ago Changed · +6 lines · +188 tokens per session 0b3c646a6be8
- 1mo ago First seen · 32 lines · 570 tokens per session scan A 05e6d91d5332
web-of-flaws AGENTS.md is an instructions file published in the GitHub repository ukorvl/web-of-flaws (9 stars, last pushed 25d ago), licensed MIT. It adds 868 tokens to every session, about $0.0035 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
deno copilot-instructions.md
Copilot instructions for denoland/deno, covering deno development guide for github copilot, network access, high level overview, key directories and key files to understand first.