Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/zexion7873/copilot-setting/securitygit clone --depth 1 https://github.com/zexion7873/copilot-settingWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01258 | $0.01258 |
| Opus 5 | $0.00629 | $0.00629 |
| Sonnet 5 | $0.00252 | $0.00252 |
| Haiku 4.5 | $0.00126 | $0.00126 |
Grade B, and why
copilot-setting security.instructions.md scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Cloud metadata endpointmediumServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
- Block private, loopback, and link-local ranges (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `127.0.0.0/8`, `169.254.0.0/16` — link-local, covers the `169.254.169.254` cloud-metadata endpoint; IPv6 `::1` and `fc00: Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Rules
Secure by default. State what risk is mitigated when writing security code. SQL injection: instructions/sql.instructions.md. XSS: instructions/jsp.instructions.md.
A01 Broken Access Control
- Deny by default; explicitly check rights per resource
- Authentication ≠ authorization: a logged-in user still needs an explicit role/permission check per endpoint — "logged in" never means "allowed"
- Allow-list for user-supplied URLs/paths; prevent path traversal
- CSRF: all state-changing POST forms must carry a CSRF token; Spring Security 3.2: configure
<csrf>in security namespace; without Spring Security: manual double-submit cookie or synchronizer token - State-changing operations via POST/PUT/DELETE only — never GET; restrict handlers with
@RequestMapping(method = ...)(a mapping withoutmethodmatches every verb and bypasses POST-form CSRF tokens)
A02 Cryptographic Failures
- Passwords: bcrypt (
BCryptPasswordEncoder, built-in to Spring Security crypto since 3.1, present in 3.2) or Argon2 (needs argon2-jvm — no native SS 3.2 encoder); never MD5/SHA-1. Data at rest: AES-256; transit: HTTPS - No hardcoded secrets — env vars or secret store
A03 Injection
- SQL:
PreparedStatementwith?only - OS command:
ProcessBuilderwith an argument list — neverRuntime.exec(String)orsh -cwith user input; no shell-string concatenation - XSS:
<c:out>in JSP; context-aware encoding - XXE: disable DTDs and external entities on every XML parser, using each API's own switch (they differ —
setFeature/disallow-doctype-declexists only on the first pair); critical in this XML-heavy stack:DocumentBuilderFactory/SAXParserFactory:setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)plusFEATURE_SECURE_PROCESSINGXMLInputFactory(StAX):setProperty(XMLInputFactory.SUPPORT_DTD, false)andsetProperty("javax.xml.stream.isSupportingExternalEntities", false)— it has nosetFeature- JAXB
Unmarshaller: no DTD switch of its own — unmarshal via aSAXSourcewrapping a hardenedXMLReaderconfigured as above
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 78 lines · 1,258 tokens per session scan B c400b2e4d278
copilot-setting security.instructions.md is an instructions file published in the GitHub repository zexion7873/copilot-setting (1 stars, last pushed 29d ago), licensed MIT. It adds 1,258 tokens to every session, about $0.0063 per session on Opus 5. A static security scan graded it B with 1 finding (cloud metadata endpoint). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
ai-agent-rules-generator copilot.instructions.md
Glitch WooCommerce Payment Gateway plugin coding guidelines — auto-doc sync for plugin, features, and infrastructure.
ai-agent-rules-generator agent-observations.instructions.md
Mandatory agent observation logging — anomalies, recommendations, and critical findings must be disclosed before commit.
ai-agent-rules-generator task.instructions.md
Task execution rules for Glitch WooCommerce Payment Gateway engineering work.
ai-agent-rules-generator doc-sync.instructions.md
Documentation sync rules — which docs to update when code changes.
ai-agent-rules-generator browsetools.instructions.md
Browser verification rules for Glitch WooCommerce Payment Gateway using Chrome DevTools MCP.
ai-agent-rules-generator devtools.instructions.md
Browser DevTools and local development access credentials.