https://github.com/yooh-an/agent-rules-auditor
Audit AI agent instruction files; optional $20 setup PR for CI safety gate.
https://github.com/yooh-an/agent-rules-auditor
agent-instructions agent-safety ai-agents claude-code codex cursor cursor-ai developer-tools github-actions security-tools
Last synced: about 1 month ago
JSON representation
Audit AI agent instruction files; optional $20 setup PR for CI safety gate.
- Host: GitHub
- URL: https://github.com/yooh-an/agent-rules-auditor
- Owner: Yooh-an
- License: mit
- Created: 2026-05-24T01:40:51.000Z (about 1 month ago)
- Default Branch: main
- Last Pushed: 2026-05-24T03:19:05.000Z (about 1 month ago)
- Last Synced: 2026-05-24T03:25:28.354Z (about 1 month ago)
- Topics: agent-instructions, agent-safety, ai-agents, claude-code, codex, cursor, cursor-ai, developer-tools, github-actions, security-tools
- Language: Python
- Homepage: https://yooh-an.github.io/agent-rules-auditor/offer.html
- Size: 44.9 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- Funding: .github/FUNDING.yml
- License: LICENSE
Awesome Lists containing this project
README
# Agent Rules Auditor
Audit AI coding-agent instruction files for risky or ambiguous rules.
This is a small open-source CLI for teams using Codex, Claude Code, Cursor, Gemini CLI, or other coding agents with repo-local instruction files.
Public repo:
Landing page:
Release:
Buy the `$20` Pro Pack with PayPal:
After payment, request delivery or a setup PR:
Request a free public repo scan:
Announcement and setup PR scope:
Ask questions about the Pro Pack:
Preview the paid bundle contents: [`PRO_PACK_PREVIEW.md`](PRO_PACK_PREVIEW.md)
Use the free GitHub Action:
See the setup PR demo: [`examples/setup-pr-demo/`](examples/setup-pr-demo/)
Live setup PR demo:
Setup PR option:
Buyer FAQ:
Delivery manifest:
Public scan index with example findings from postgis, bpftrace, FastLED, and
other public instruction files:
Keyword landing pages:
- AGENTS.md audit:
- Cursor rules audit:
- Claude Code instructions audit:
It scans:
- `AGENTS.md`
- `CLAUDE.md`
- `GEMINI.md`
- `RULES.md`
- `.cursorrules`
- `.cursor/rules/*.md`
- `.cursor/rules/*.mdc`
Instruction file names are matched case-insensitively, so `AGENTS.MD` and
`Agents.md` are scanned too.
It flags risky patterns such as:
- destructive commands without approval language
- force-push instructions
- secret exposure instructions
- remote-code execution patterns
- privileged commands
- attempts to override higher-priority instructions
- vague "fix everything" scope
## 30 Second Demo
Run the included unsafe sample:
```bash
PYTHONPATH=src python3 -m agent_rules_auditor.cli examples/unsafe/AGENTS.md --fail-on none
```
You should see findings for destructive commands, secret exposure, remote
execution, instruction override language, and vague scope.
The `examples/` directory is skipped during whole-repo audits so the demo file
does not make this repository fail its own check.
## Install
From this directory:
```bash
python3 -m pip install .
```
Install directly from GitHub:
```bash
python3 -m pip install "git+https://github.com/Yooh-an/agent-rules-auditor.git"
```
Install the current release:
```bash
python3 -m pip install "git+https://github.com/Yooh-an/agent-rules-auditor.git@v0.1.3"
```
For local development without installation:
```bash
PYTHONPATH=src python3 -m agent_rules_auditor.cli .
```
## Usage
Audit the current repo:
```bash
agent-rules-audit .
```
Return JSON:
```bash
agent-rules-audit . --json
```
Fail CI on warnings:
```bash
agent-rules-audit . --fail-on warn
```
Disable failing:
```bash
agent-rules-audit . --fail-on none
```
## GitHub Action
Use the free action in pull requests:
```yaml
name: Agent Rules Audit
on:
pull_request:
jobs:
audit-agent-rules:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: Yooh-an/agent-rules-auditor-action@v0.1.3
with:
fail-on: warn
```
See for inputs and setup notes.
## Example Output
```text
Agent instruction audit: 1 finding(s)
errors=1 warnings=0 info=0
ERROR AGENTS.md:12 [destructive-command]
Instruction mentions a destructive command.
Excerpt: Run git reset --hard when tests fail.
Fix: Require explicit user approval and a narrow path or target before destructive actions.
```
## Open Source Core
The CLI is MIT licensed.
The paid product is the `$20 Agent Rules Pro Pack`: a setup bundle for teams that want to add this to a repo quickly without writing policy and CI files from scratch.
For public GitHub repositories, the `$20` purchase can also include a setup PR
that adds the workflow, starter policy, Cursor rule, and PR checklist directly
to the buyer's repo.
The Pro Pack includes:
- strict `AGENTS.md` template
- dry-run-first setup script
- Cursor `.mdc` safety rule
- GitHub Actions workflow
- PR checklist text
- reviewer prompt for risky agent-rule diffs
- setup PR for public GitHub repos
- team rollout checklist
- sample audit report
- buyer onboarding email
See `PRO_PACK.md` for the sales page copy and delivery promise.
Use the free GitHub Action:
See `examples/setup-pr-demo/` for the concrete PR files a buyer can expect
when they request the public-repo setup PR option.
See the live setup PR demo:
See the setup PR option page:
Buy the `$20` Pro Pack with PayPal:
The GitHub Sponsor button is configured through `.github/FUNDING.yml` to point
to the same purchase and setup PR links.
After payment, open the purchase thread to request delivery or a setup PR:
For GitHub Action setup PR requests, you can also use:
See the announcement for the setup PR scope:
Use the Q&A discussion for pre-purchase questions:
Request a free scan for a public repository:
See `PURCHASE.md` for the structured purchase request form and delivery notes.
See `BUYER_FAQ.md` for what is included, how delivery works, and when not to
buy the pack.
See `DELIVERY_MANIFEST.md` for the current paid ZIP hash, included files, and
setup-script verification notes.
See `PUBLIC_SCAN_EXAMPLES.md` for concrete findings from public AGENTS.md and
Cursor rule files.
Use `checkout-setup.md` if you need to replace the PayPal link with another
checkout provider.
## Support And Contributing
- [`SUPPORT.md`](SUPPORT.md) explains where to file CLI bugs and paid delivery requests.
- [`CONTRIBUTING.md`](CONTRIBUTING.md) covers local development and pull requests.
- [`SECURITY.md`](SECURITY.md) defines the safe reporting scope.
- [`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md) defines basic project behavior.
## Run Tests
```bash
PYTHONPATH=src python3 -m unittest discover -s tests
```
If macOS Python cannot write bytecode caches:
```bash
PYTHONPYCACHEPREFIX=/private/tmp/agent-rules-pycache python3 -m compileall src tests
```