Free tool: runs in your browser
AI agent instruction file review checklistbefore an AI coding agent reads AGENTS.md, CLAUDE.md or a rules file
TimeBinder adds a layer of protection against AI and human fraud and disputes. Check who can change the instruction files, what the agent can do when it reads them, and whether you keep a dated copy of the files you reviewed.
Nothing you tick is sent anywhere. This page cannot scan a file or tell you whether an instruction file, an agent or a repository is safe. It is not security advice. The reports it mentions are the authors’ statements, and the tools they describe change often.
Check who can change the files, what the agent can reach and the copies you keep
Tick what is true about your repositories and tools. You get a shareable result and clear next steps. Nothing you tick is sent to TimeBinder.
Your choices stay on this page. Nothing you tick is sent anywhere or tied to your name.
Tick everything that is true about the instruction files your AI coding agents read
This looks at who can change AGENTS.md, CLAUDE.md and rules files, whether they are reviewed like build configuration, whether agents run on pull requests with secrets in reach, and whether you keep a dated copy of the reviewed file. It is not a scanner and cannot tell you whether a file is safe.
What to do now
What should I check before an AI coding agent reads AGENTS.md or CLAUDE.md? The short answer
Treat instruction files such as AGENTS.md, CLAUDE.md, .cursor/rules and .github/copilot-instructions.md like build configuration. Read them before the agent does, especially in a repository you did not write or a folder you just unzipped. Require a named reviewer for changes, do not let the agent edit them without asking, and keep secrets out of reach of any agent that runs in auto-approve mode or on pull requests from forks. The OWASP cheat sheet on secure coding with AI lists rules files as persistent steering that a malicious pull request or the agent itself can change, and says to review them with the same scrutiny as CI/CD pipeline changes.
This checklist cannot scan a file or tell you whether it is safe. A TimeBind of a file you already hold, such as the AGENTS.md you reviewed, can show that exact file existed no later than a recorded time and still matches. It does not show that the file is safe or that an agent will follow it.
Why this came up in November 2026
A research paper, GitInject, describes prompt injection in AI-powered CI/CD pipelines. It says that provider configuration files such as CLAUDE.md, AGENTS.md and GEMINI.md added in a pull request branch can be loaded by the agent as authoritative operator-level instructions before any pull request content is processed. A Cloud Security Alliance research note describes repository files that coding assistants ingest as trusted context as an indirect prompt injection surface across the tools it evaluated. A post on Gloss reports a test in which an AGENTS.md planted in a Downloads folder was loaded by Claude Code from subfolders, and that the author’s agents followed the planted instruction in some runs and not in others. These are the authors’ statements and this page does not treat them as more than that.
Measured demand is visible. Checked on 13 November 2026, about 6:25 AM Australia/Brisbane. Google autocomplete for “agents.md” returned “agents.md file”, “agents.md vs claude.md”, “agents.md examples”, “agents.md best practices”, “agents.md format”, “agents.md standard” and “agents.md generator”. Autocomplete shows what people type. It is not search volume.
For the secrets that sit next to these files, see the AI coding assistant settings file secrets checklist.
Sources: GitInject, arXiv, OWASP: Secure Coding with AI Cheat Sheet, Cloud Security Alliance research note and Gloss.
What this checklist does and does not do
The honest job of this page is to put the checks in a sensible order, not to audit any file or tool. See also the AI agent file access checklist and the glossary entries for existed no later than and fingerprint.
| Part | What it does | What it does not do |
|---|---|---|
| Who can change the files | Reminds you to ask for a named reviewer on changes to instruction files and to list which ones your tools load. | Tell you whether a file contains an injected instruction. |
| What the agent can do | Reminds you to keep secrets out of reach of agents in CI, on fork pull requests or in auto-approve mode. | Limit what an agent can do. |
| Where files come from | Reminds you to check a cloned or unzipped folder for an AGENTS.md before opening it with an agent. | Scan a folder. |
| A TimeBind of a file you already hold | Records that an exact file existed no later than a recorded time and still matches, using a SHA-256 fingerprint made in your browser. The file stays on your device. | Show that an instruction file is safe or that an agent will follow it. |
If the files you reviewed are something you may need to show later
After you review a repository’s instruction files:
- Keep a dated copy of each instruction file you reviewed, such as AGENTS.md or CLAUDE.md.
- Make a TimeBind of each exact file you already hold. The fingerprint is made in your browser and the file stays on your device. You can later download a Proof of Time Certificate.
- Store the files, your review notes and the certificate together, with the date of each review.
A TimeBind shows the exact file existed no later than the recorded time and still matches. It cannot show that a file is safe.
First Pooled TimeBind free, no card, then from US$5. An ASAP TimeBind is US$15.
What a TimeBind shows, and what it does not. It shows that an exact file existed no later than a recorded time and that a copy shown later still matches its fingerprint. It does not show who made the file, who owns it, that its contents are true, or whether AI was used to make or edit it. This is general information, not legal advice.
If contributors use AI coding agents on your repository, the free AI contribution policy note builder drafts a CONTRIBUTING.md section and a pull request checklist. It cannot tell whether a change was written with AI.
AI agent instruction file review checklist: FAQ
What is an AGENTS.md file?
It is a Markdown file of instructions that some AI coding agents read from a repository. Because the agent reads it as instructions, anyone who can change it can change what the agent is told.
Can a pull request change what my agent is told?
The GitInject paper says it can, where a CI agent loads instruction files from the pull request branch. Check how your own pipeline checks out code and whether the agent runs on fork pull requests with secrets in reach.
Does this checklist scan my files?
No. It runs in your browser and only helps you plan the order of the checks.
Does a dated record show that a file is safe?
No. A TimeBind of a file you already hold can show that exact file existed no later than a recorded time and still matches. It does not show that the file is safe.
Is this security advice?
No. It is a list of checks. Follow your own security team’s guidance and each tool’s documentation.
Is anything I tick sent to TimeBinder?
No. The checklist runs in your browser. Your ticks stay on the page.
Related guides and tools
- AI coding assistant settings file secrets checklistSecrets next to settings files
- AI agent file access checklistWhat an agent can read
- MCP server install checklistAnother agent trust boundary
- GitHub Actions workflow lockfile checklistCI configuration checks
- GlossaryPlain definitions of fingerprint, SHA-256 and existed no later than
- All free toolsPrivate, in-browser tools
Date the exact files you already hold
Add a layer of protection against AI and human fraud and disputes: a dated, checkable record of the instruction files you reviewed.
- Open the app and sign in with email or Google.
- Add your files. They stay on your computer.
- Seal them and download your Proof of Time certificates.
First Pooled TimeBind free, no card, then from US$5. See pricing.