One line in AGENTS.md such as "commit with --no-verify" turns off your git hooks for every task the agent does, a token pasted into CLAUDE.md is sent to the model provider with every request, and an HTML comment that GitHub never shows can tell the agent to run a script. This skill finds those and seven other mistakes in agent instruction files, and tells you how to fix each one.

Your agent runs a scanner on AGENTS.md, CLAUDE.md and the .claude rules, subagents and slash commands, GEMINI.md, Cursor .mdc rules and .cursorrules, Copilot's copilot-instructions.md and *.instructions.md, and Windsurf and Cline rules, in every folder of the project. It tells prohibitions from orders ("Never use --no-verify" is fine), treats HTML comments and invisible Unicode as hidden text, reads @path imports the way Claude Code does (relative to the file, not inside code), and checks each tool's frontmatter keys against that tool's documentation. It never runs anything the files say. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• A01: passwords, tokens and API keys in the instructions, or @.env and key files imported into them

• A02: orders that switch off safeguards: --no-verify, --dangerously-skip-permissions, --yolo, force-push to main, rm -rf ~, never ask before deleting or deploying, delete failing tests

• A03: hidden text: HTML comments that carry commands or deception, Unicode tag characters, bidi overrides and zero-width runs

• A04: orders to hide actions from the user, override the user's or system instructions, or send secrets to an outside address

REVIEW (check before release)

• A11: files longer than the tool reads well (CLAUDE.md over 200 lines, .mdc rules over 500, AGENTS.md over 32 KiB)

• A12: @path imports, mdc: links and Markdown links to files that do not exist

• A13: rule frontmatter that does not work: .md files in .cursor/rules, alwaysApply with globs, globs instead of paths, unquoted * patterns

• A14: downloads piped into a shell (curl | sh, iwr | iex)

• A15: install commands for a package manager the project does not use

• A16: personal home-folder paths such as C:\Users\name or /Users/name

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example project, and the real report the scanner produces on the risky one

Limits

It reads each file as written: skills in .claude/skills, user-level files outside the project (~/.claude/CLAUDE.md, ~/.codex/AGENTS.md, global Cursor or Windsurf rules), settings that change which files load, and the content of imported files that are not instruction files are not checked. Whether a sentence is an order or a prohibition is decided from its wording, so unusual phrasing can be missed. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 30 files: SKILL.md, the scanner in scripts/ (4 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (23 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.