Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/zexion7873/copilot-setting/jspgit clone --depth 1 https://github.com/zexion7873/copilot-settingWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00556 | $0.00556 |
| Opus 5 | $0.00278 | $0.00278 |
| Sonnet 5 | $0.00111 | $0.00111 |
| Haiku 4.5 | $0.00056 | $0.00056 |
Grade A, and why
copilot-setting jsp.instructions.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
JSP Conventions
Output Encoding
- Every dynamic value:
<c:out value="${...}"/>orfn:escapeXml()— no raw${...}in HTML - Attribute context requires a double-quoted attribute — escaping cannot stop unquoted-attribute breakout
- Never put
${...}in an inline event handler (onclick) orjavascript:URL — escaping cannot make these safe; pass via an HTML-escapeddata-*attribute and read it from JS - JS context: JSON-encode server-side with
<escaped as\u003c, or pass via adata-*attribute - URL context:
<c:url>with<c:param>
JSTL Only
- No scriptlets (
<% ... %>); no<%= ... %>— use<c:out> - Logic:
<c:if>,<c:choose>,<c:forEach>; formatting:<fmt:formatDate>,<fmt:formatNumber>
Includes
<jsp:include>for dynamic;<%@ include %>for static; never include user-supplied paths
Data Preparation
- JSP must NOT trigger lazy loading — prepare all data in the controller/service before forwarding (
instructions/spring-hibernate.instructions.md); a lazy-collection hit in a JSP means the service missed an eager fetch — fix the service, not the JSP
Anti-Patterns
| Pattern | Problem | Fix |
|---|---|---|
${user.name} unencoded |
XSS | <c:out value="${user.name}"/> |
title=${x} (unquoted attribute) |
Breakout via space / = despite escaping |
title="<c:out value='${x}'/>" |
onclick="do('${x}')" |
EL in event handler — escaping doesn't neutralize | data-* attribute, read from JS |
<%= request.getParameter("q") %> |
Scriptlet + unencoded = XSS | <c:out value="${param.q}"/> |
<% if (cond) { %> |
Java in the view | <c:if test="${cond}"> |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 38 lines · 556 tokens per session scan A 63fe08970ae9
copilot-setting jsp.instructions.md is an instructions file published in the GitHub repository zexion7873/copilot-setting (1 stars, last pushed 29d ago), licensed MIT. It adds 556 tokens to every session, about $0.0028 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
ai-agent-rules-generator copilot.instructions.md
Glitch WooCommerce Payment Gateway plugin coding guidelines — auto-doc sync for plugin, features, and infrastructure.
ai-agent-rules-generator agent-observations.instructions.md
Mandatory agent observation logging — anomalies, recommendations, and critical findings must be disclosed before commit.
ai-agent-rules-generator task.instructions.md
Task execution rules for Glitch WooCommerce Payment Gateway engineering work.
ai-agent-rules-generator doc-sync.instructions.md
Documentation sync rules — which docs to update when code changes.
ai-agent-rules-generator browsetools.instructions.md
Browser verification rules for Glitch WooCommerce Payment Gateway using Chrome DevTools MCP.
ai-agent-rules-generator devtools.instructions.md
Browser DevTools and local development access credentials.