knowledge/agent-md-creator/SKILL.md
Create, update, or refactor repository-root and nested AGENTS.md files for AI coding agents. Use when the user asks to bootstrap AGENTS.md, replace tool-specific instruction files with a shared open format, compress overly verbose agent instructions, document build/test commands for agents, or design minimal project instructions for monorepos and subprojects.
npx skillsauth add aeondave/malskill agent-md-creatorInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Create technical, token-efficient AGENTS.md files that help coding agents work immediately without bloating context. Treat AGENTS.md as a living operational file: it should evolve with the codebase, discovered workflows, current tool availability, and real team practices. Prefer compact, evidence-based instructions over generic prompting.
Before drafting anything:
AGENTS.md, AGENT.md, .github/copilot-instructions.md, CLAUDE.md, .cursorrules, README files, and CI workflows.AGENTS.md files are needed.If you need structure, precedence, or section guidance, load references/agents-md-principles.md. If you need the 2025 GitHub-specific lessons from analysis of 2,500+ repositories, load references/github-lessons.md.
Default to a single root AGENTS.md.
Add nested AGENTS.md files only when at least one of these is true:
Keep instructions local: the nearest AGENTS.md should carry only the details relevant to that subtree.
Use only sections supported by evidence from the repo. Preferred order:
Write short bullets, concrete paths, and exact commands. Prefer this:
pytest tests/api/test_users.py -qnpm run lintsrc/api/ contains HTTP handlersCode comments must be technical, precise, and written in English; explain why or intent, not obvious syntaxAdd or update tests for changed behavior in tests/api/If debugging stalls after 2–3 failed iterations, ask before using online researchUse Tavily for online research when external lookup is neededUse objdump for binary inspection before switching toolsIgnore the existing warning in src/ui/App.tsx unless the user reopens itgo vet ./... # one pre-existing unsafe.Pointer warning in injection/ is accepted — do not fix itRegenerate the resource blob after changes in evasion/ or injection/: bash scripts/gen.shFor ## Project structure, stop at the folder level unless a specific file is truly operationally important. Describe what each directory contains or should contain. Do not dump long file inventories. Mark generated files inline when their presence causes confusion (e.g., resources.enc ⚡ GENERATED — do not edit). When a subdirectory has its own specialized rules, write See <path>/AGENTS.md to keep the root lean instead of duplicating content.
Avoid this:
README.md or a reference fileProject structure sections listing every file in the repoIf the user asks for a starter file from scratch, use assets/minimal-agents-template.md as the base and then replace every placeholder with repo-specific facts.
When the user declares operational choices during chat sessions, capture them in a clear dedicated section if the file does not already have one.
Typical examples:
objdump, readelf, pytest, dlv, or platform-specific debuggersRecommended section names:
## Active user decisions## Working agreements## Current tool choicesState these decisions as active but revisable. The file should make it clear that they can be changed or retracted later without rewriting unrelated guidance.
When the project has a test suite or test conventions, say so explicitly in AGENTS.md:
Do not promise test creation blindly for repos where tests are intentionally absent, generated elsewhere, or not appropriate for the project type.
If the repository often requires debugging, encode that workflow in AGENTS.md with short, operational bullets:
If the user explicitly says that a warning, lint issue, or UI diagnostic should not be changed, store that in a dedicated section instead of letting the agent rediscover it constantly.
Good examples:
## Accepted diagnostics## Known ignored warnings## Deferred issuesEach entry should be short and scoped:
This helps the agent avoid repeatedly analyzing the same accepted warning and preserves flow across sessions.
The default target is a short file that an agent can load often without wasting context.
Load references/optimization-checklist.md when tightening a draft or reviewing an existing verbose file. Use references/github-lessons.md when you want concrete guidance on command order, examples, boundaries, and the six high-value sections.
When an instruction file already exists:
AGENTS.md when the goal is a portable, tool-agnostic formatAGENTS.md whenever important repository changes, discovered workflows, or tool availability affect how the agent should workWhen migrating from tool-specific files, keep compatibility notes short and prefer a single source of truth.
Check that the final AGENTS.md:
Project structure focused on directories and high-signal paths, not exhaustive file listingsREADME.md or a reference file instead of leaving it in AGENTS.mdProject structure, prefer folders plus one short explanation of what lives there.Testing, say whether tests must be added or updated for behavioral changes.Debugging, prefer a short escalation rule: local tools first, then user-approved online research if repeated attempts fail.AGENTS.md as a living operational file: update it when the project changes, when better workflows are discovered, or when available tools materially change.AGENTS.md; the latter belongs in README.md by default, or in a dedicated reference file when it is too detailed for the README. If a section describes code internals rather than directing agent behavior, move or remove it.forbidden → use instead table over prose rules.## Commands## Active user decisions## Testing## Debugging## Project structure## Accepted diagnostics## Boundaries## Workspace commands## Working agreements## Package discovery tips## Testing strategy## Debugging strategy## Accepted diagnostics policy## Nested AGENTS.md policy## Local commands## Local decisions## Local testing## Local debugging## Local accepted diagnostics## Files in scope## Local conventions## Do not touchFor projects where using certain patterns is security-critical, OPSEC-important, or compatibility-breaking, document as a compact two-column table (forbidden pattern → safe alternative). Pair each constraint with a clear replacement so the agent has a path forward. Example:
| Forbidden | Use instead |
|-----------|-------------|
| crypto/rand | math/rand seeded via time.Now().UnixNano() |
| math/rand/v2 | math/rand (v1) for TinyGo compatibility |
Place this in a dedicated section such as ## Hard constraints or inline under ## Conventions.
## Checklist for new codeFor complex projects with many non-obvious rules, a bulleted checklist is more actionable than prose conventions — each item is something the agent can explicitly verify before finishing. Keep it to rules the agent could realistically miss. Useful when violations are hard to catch in review and have significant impact (security, OPSEC, ABI compatibility, naming conventions).
If the repository has strong expectations for source-code comments, capture them as 1–3 short bullets under ## Conventions or ## Code style. Good guidance is qualitative, not quantitative: comments should be technical, precise, written in English, and used for intent, invariants, hazards, or non-obvious reasoning. Avoid rules that encourage a comment for every line or every function regardless of value.
For modular or plugin-style architectures (interface + init() registration, strategy pattern, encoder stacks), a short numbered "Adding a new X" section (4–8 steps) prevents the agent from missing required steps. Cover: file placement, interface implementation, self-registration, flag wiring, and any alias or build updates needed. Do not reproduce the full interface spec — just the steps required to add a new instance correctly.
AGENTS.md files.assets/minimal-agents-template.md — minimal starter template for root AGENTS.md files; customize every placeholder with repo-specific facts before saving.development
White-box auditing methodology for AI-generated ('vibe-coded') applications. Focuses on modern stack misconfigurations (Supabase, Next.js, Vercel).
development
Hybrid AI/Deterministic SAST methodology for discovering zero-day vulnerabilities in source code. Orchestrates structural search with AI-driven data flow and sink validation.
development
Auth assessment: hardware/embedded methodology; UART/JTAG/SWD/SPI/I2C, firmware extraction, boot/debug paths, embedded OS evidence.
devops
Container methodology: Identifying containerization limits, Docker/K8s misconfigurations, and executing escapes to the host node.