agents-md-generator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited agents-md-generator (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create portable, high-signal AGENTS.md files that are grounded in the actual repository and remain especially useful for Codex-style coding agents.
new, revise, or migrate.AGENTS.md.AGENTS.md files only when the repo structure clearly needs local overrides.Do not skip repo inspection unless the user gives the full repo context directly.
Start by classifying the request:
new: create a root AGENTS.md for a repo that does not have onerevise: improve an existing AGENTS.mdmigrate: consolidate repo guidance from files such as CLAUDE.md, README.md, CONTRIBUTING.md, or CI config into a cleaner AGENTS.mdIf the user asks for "agent instructions", "repo instructions", or "coding-agent guidance", treat that as an AGENTS.md request unless they clearly want another format.
Before asking questions, inspect the repo for the facts that should shape the file.
Look for:
AGENTS.md, CLAUDE.md, README.md, CONTRIBUTING.md, and release docs.github/workflows/Prefer targeted inspection over broad reading. Open the minimum set of files needed to answer:
Use references/inspection-and-content-checklist.md to make sure the repo inspection and final file are complete.
After inspection, ask only questions that materially change the final AGENTS.md.
Typical missing questions:
AGENTS.md files in specific subtreesDo not ask questions that the repo can answer on its own.
If ambiguity remains and the user does not care, choose a sensible default and mark it as an explicit assumption in the final draft.
AGENTS.mdDefault output is a root AGENTS.md.
The file should be concise, executable, and repo-specific. Include only the sections that improve agent execution.
Typical content:
Do not write a generic manifesto. Prefer concrete commands, boundaries, and decision rules.
When revising:
AGENTS.mdDo not create or recommend nested files by default.
Recommend nested AGENTS.md only when a subtree has materially different:
If nested files are warranted, state clearly:
Use references/nested-files-and-token-optimization.md for the decision rules.
Before finalizing:
git ls-files and the currentroot directory so durable docs do not claim missing files or omit published tracked files
If a topic is useful but bulky, move the detail to existing repo docs and point to them from AGENTS.md instead of inflating the file.
The finished AGENTS.md should:
User request: Create an AGENTS.md for this repository.
Expected behavior:
AGENTS.md with setup, test, lint, review, and safety rules.User request: Convert this repo's CLAUDE.md guidance into AGENTS.md.
Expected behavior:
AGENTS.md.AGENTS.md and note whether any nested overrides are needed.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.