project-memory — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited project-memory (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create a project instruction file that transfers institutional knowledge, not obvious information. Think like a senior journalist onboarding a competent colleague. Do not explain how journalism works; explain this project's quirks.
Resolve the target before writing:
AGENTS.md exists, update it. If no CLAUDE.md exists, thenin Claude Code, also create a one-line CLAUDE.md that imports it with @AGENTS.md. Claude Code loads CLAUDE.md, not AGENTS.md.
CLAUDE.md exists, update it.AGENTS.md. In Claude Code, also create thesame one-line CLAUDE.md import.
Do not create competing copies of the same guidance. Keep nested instruction files only when a subdirectory needs narrower rules than its parent.
A project instruction file gives standing context to the active client. It does not enforce a rule by itself.
In Claude Code, CLAUDE.md content is delivered as user context after the system prompt. Claude reads it and tries to follow it, but the file does not guarantee strict compliance with vague or conflicting instructions. Source: https://code.claude.com/docs/en/memory
| Mechanism | Use for | Behavior |
|---|---|---|
| Project instruction file | Standing facts, commands, conventions, and boundaries | Advisory context |
| Skills | Multi-step procedures and on-demand workflows | Loaded when relevant |
| Client enforcement | Actions that must block or run every time | Deterministic only when the client blocks, for example, a Claude Code hook that exits 2 or returns a PreToolUse deny. A prompt hook only adds a reminder |
Do not use a client hook as load-bearing shared behavior. If a rule must work in both Claude Code and Codex, state the rule in the project instruction file and document any optional client enforcement separately.
If an instruction is "block writes to published/" or "run an accessibility check before commit," use client enforcement. If it is a "fact-check workflow" or "FOIA-letter drafting," use a skill. Keep standing project facts and rules in the project instruction file.
Claude Code guidance for effective instruction files includes an explicit include/exclude list. Source: https://code.claude.com/docs/en/best-practices
Include information an agent cannot infer reliably from the repository:
secret values.
project.
Exclude information the agent can discover cheaply:
For journalism projects:
byline policy, embargo handling, source-protection invariants, and CMS quirks (for example, "story slugs must be unique across all desks, not just metro").
specifics. Every newsroom already knows both.
For every line, ask: Would removing this make a capable agent more likely to make a project-specific mistake? If not, remove it.
Use short sections and direct instructions. Treat 200 lines as a review threshold, not a target. When the file grows:
notes file.
If both supported clients are used, keep shared guidance in AGENTS.md and let CLAUDE.md import it. Add client-specific guidance only when the behavior cannot be expressed portably, and label the client.
Client-specific scoping options:
.claude/rules/ files with paths: frontmatter load only whenthe agent works on matching files. An @import loads in full at launch, so it does not reduce context size.
AGENTS.md applies to its directory and below.In Claude Code, more specific locations take precedence. Source: https://code.claude.com/docs/en/memory
| Scope | Claude Code location | Use case |
|---|---|---|
| Managed policy | Linux/WSL: /etc/claude-code/CLAUDE.md<br>macOS: /Library/Application Support/ClaudeCode/CLAUDE.md<br>Windows: C:\Program Files\ClaudeCode\CLAUDE.md | Organization standards that individual settings cannot exclude |
| Project | ./CLAUDE.md or ./.claude/CLAUDE.md | Team-shared instructions checked into version control |
| User | ~/.claude/CLAUDE.md | Personal preferences across projects |
| Local | ./CLAUDE.local.md | Gitignored personal project notes |
In Codex, instructions load from global scope through the current working directory. Later directories override earlier ones, and AGENTS.override.md takes precedence over AGENTS.md in the same directory. Source: https://developers.openai.com/codex/guides/agents-md
| Scope | Codex location | Use case |
|---|---|---|
| User | ~/.codex/AGENTS.md | Personal instructions across projects |
| Project and nested directories | AGENTS.md from the repository root through the current working directory | Shared rules with narrower directory scope |
| Override | AGENTS.override.md | Replace AGENTS.md for the same directory when a temporary or stronger override is required |
For journalism teams that use multiple agents, keep shared editorial standards, source-handling invariants, and fact-check protocols in the canonical shared file. Those rules belong to the organization, not one client.
advice. In Claude Code, if Claude keeps ignoring a rule, the file is probably too long and the rule is getting lost.
stating which scope wins.
reality changes.
In Claude Code v2.1.59 and later, auto memory stores notes under ~/.claude/projects/<project>/memory/. The first 200 lines of MEMORY.md load into each session. Source: https://code.claude.com/docs/en/memory
Do not ask the user to write down things Claude learns through corrections. Auto memory handles those notes. Project instructions hold durable facts that the team writes and reviews.
Bad, because it explains obvious setup and gives no institutional knowledge:
# Project instructions
## Overview
Welcome to our newsroom's story tracking system. This React and Node.js app
helps editors and reporters collaborate on stories.
## Getting started
npm install
npm startGood, because it records only project-specific behavior:
# Project instructions
## Overview
Story tracker for the metro desk. React + Supabase.
## Gotchas
- Story slugs must be unique across all desks, not only metro.
- "Hold" does not stop the autopublish cron. Use "Kill."
- The reporter dropdown caches for one hour. New hires do not appear sooner.
## Commands
npm run sync-ap # Pull latest from AP. Runs automatically at :15.
## Credentials
The Supabase key is in the 1Password "Metro Desk" vault, not `.env`.Templates are in the templates/ directory:
| Template | Use for |
|---|---|
editorial-tool.md | Newsroom tools, fact-checkers, and AI assistants |
event-website.md | Conferences, workshops, and campaign sites |
publication.md | Newsletters, podcasts, and continuing publications |
research-project.md | Investigations and scoped data research |
content-pipeline.md | CMS workflows and publishing automation |
digital-archive.md | Historical collections and document repositories |
applies to the target scope.
owners, paths, or service state.
AGENTS.md in Claude Code, create the one-line import filedescribed above.
# Project instructions
## Commands
- Test: [exact command]
- Lint: [exact command]
## Project rules
- [Non-obvious rule that changes how work is done.]
- [Approval or safety boundary.]
## Known failure modes
- [Symptom]: [Cause and verified recovery.]Start small. Add a rule only after the project demonstrates that agents need it.
Read Pinned repository ledger when several agents, runtimes, or people coordinate in one repository.
2026-05-09. Sources verified: https://code.claude.com/docs/en/memory and https://code.claude.com/docs/en/best-practices. Codex instruction scoping was checked against official OpenAI documentation on 2026-10-23.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.