A complete example
This example shows every frontmatter field and a one-line prompt body.---
slug: sql-injection
name: SQL Injection
description: SQL built from untrusted input instead of parameterized queries.
version: 0.1.0
author: your-github-handle
noiseTier: normal
precondition: # optional, omit to always run
regex:
patterns:
- regex: "\\.(query|execute)\\s*\\("
in: ["**/*.{ts,js,py,go,php}"]
# prompt: "Run only if this project talks to a SQL database." # optional LLM gate
where:
extensions: [ts, js, py, go, php]
excludePatterns: ["**/*.{test,spec}.*"]
preFilter:
- { regex: "\\.(query|execute)\\s*\\(", label: "raw SQL call" }
references:
- CWE-89
- OWASP-A03:2021
---
You are reviewing source code for SQL injection...
Frontmatter fields
| Field | Required | Description |
|---|---|---|
slug | Required | A unique identifier in kebab-case. The -t flag can select the agent by this value. |
name | Required | A human-readable name for the agent. |
description | Required | A one-line summary. The agentgg agents list command shows it. |
version | Optional | A semantic version string, for example 0.1.0. The default is 0.0.1. |
author | Optional | The author’s GitHub handle. Official agents use agentgg. The default is no author. |
noiseTier | Optional | One of precise, normal, or noisy. See the table below. The default is normal. |
precondition | Optional | A gate that decides whether the agent runs on a repository. Omit it to always run. |
where | Optional | The files the agent scans, chosen by extension, glob, or a prefilter regex. The default is every file. |
references | Optional | A list of identifiers for triage, for example CWE-89 or OWASP-A03:2021. |
The slug rule
The
slug value must match the filename. The filename must be <slug>.md.noiseTier
ThenoiseTier field sets the false-positive rate to expect from the agent. It does not change how the agent runs.
| Value | What to expect |
|---|---|
precise | This tier has few false positives. |
normal | This tier has a typical rate of false positives. |
noisy | This tier has many false positives. Expect to dismiss some findings. |