agents-md-setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited agents-md-setup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Make `AGENTS.md` the single source of truth for agent/project instructions, and point every tool's file at it via symlink. One file, read by all agents — no duplication, no drift.
AGENTS.md is the emerging cross-tool standard (Cursor, Codex, and others readit).
CLAUDE.md. You cannot make the harness read AGENTS.mdinstead via a prompt or a skill — but a symlink CLAUDE.md → AGENTS.md means Claude opens CLAUDE.md and gets AGENTS.md's content. That is the mechanism; nothing else is needed.
AGENTS.md only; every agent stays in sync.AGENTS.md from the template below. git mv CLAUDE.md AGENTS.md # preserve history (or: mv if not tracked)into AGENTS.md (it wins as the canonical file), confirm with the user if the contents differ, then remove the standalone CLAUDE.md.
ln -s AGENTS.md CLAUDE.md
git add AGENTS.md CLAUDE.md # git stores it as a real symlink (mode 120000)Verify it committed as a symlink, not a copy:
git ls-files -s CLAUDE.md # mode should be 120000Optionally point other tools at the same file:
ln -s AGENTS.md GEMINI.md
mkdir -p .github && ln -s ../AGENTS.md .github/copilot-instructions.mdKeep a root `AGENTS.md` for repo-wide conventions (with the CLAUDE.md symlink as above), then add a scoped `AGENTS.md` in each workspace that needs its own rules — apps/<app>/AGENTS.md, packages/<pkg>/AGENTS.md — each with its own sibling symlink created from inside that directory so the target is relative:
cd apps/web && ln -s AGENTS.md CLAUDE.md # CLAUDE.md -> ./AGENTS.md (same dir)CLAUDE.md for the files it's working on, sonested files supplement the root rather than replace it. Put repo-wide things at the root; put only the package-specific delta in each workspace — don't duplicate the root.
CLAUDE.md while cd`'d into the workspace), never pointing back at the root — relative same-dir links survive checkout/move.
turbo.json change is needed**. If you want them surfaced, you can still note the convention in the root AGENTS.md.
If there's no README.md, scaffold a minimal one (project name, one-line description, setup/run commands). Keep human-facing docs in README.md and agent instructions in AGENTS.md — don't merge the two.
Git symlinks need core.symlinks=true and can break on Windows checkouts or some CI runners (the symlink lands as a text file containing AGENTS.md). If the project targets Windows, prefer the fallback: a tiny real CLAUDE.md whose entire content is a pointer —
See [AGENTS.md](./AGENTS.md) for project + agent instructions.— accepting that it must be kept in sync manually (or via a check). Symlink is better everywhere symlinks are reliable.
If you see CLAUDE.md as a symlink to AGENTS.md, that's intentional — edit AGENTS.md, never replace the symlink with a copy.
# AGENTS.md
Instructions for AI agents and humans working in this repository.
`CLAUDE.md` is a symlink to this file; this file is the source of truth.
## Project overview
<what this is, in 1–3 sentences>
## Commands
- install: `…`
- dev: `…`
- build: `…`
- test / lint / format: `…`
## Conventions
- <code style, language/runtime, formatting>
- Commit messages: <e.g. Conventional Commits>
- <anything an agent must not do, or must always do>
## Layout
<key directories and what lives where>~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.