Overview

An agent is one markdown file. It has YAML frontmatter and a prompt body. There are no execution modes.

The three parts

Part	Key	Purpose
Precondition	`precondition`	Decides whether the agent runs on this repository.
Where	`where`	Selects the files the agent scans.
Instructions	None	Tells the agent what to find. This is the prompt body.

Categories

The agent library groups agents into categories. By default, every category runs except deep/. Point -t at a category folder to run only that category.

Category	What it checks
`ai/`	AI agent loops and tool-calling code, for unbounded loops and unsafe tool definitions.
`auth/`	Authentication and authorization code, including sessions and access checks.
`cloud/`	Cloud function handlers and identity permissions on AWS, GCP, and Azure.
`cryptography/`	Cryptographic code, for weak algorithms, unsafe deserialization, and unchecked symlink writes.
`deep/`	Broad-net variants of other agents. See the warning below.
`infrastructure/`	Docker, Kubernetes, Terraform, and GitHub Actions configuration, plus sandbox runtimes that execute untrusted code.
`injection/`	Injection flaws, including SQL, command, and cross-site scripting.
`logic/`	Application logic, for race conditions, async bugs, and missing bounds checks.
`misconfiguration/`	Configuration, including Cross-Origin Resource Sharing (CORS), caching, cookies, and feature flags.
`mobile/`	Android and iOS code.
`smartcontract/`	Solidity smart contracts, for access-control and reentrancy flaws.

deep/ agents cast a wide net. They do not run by default. Add -t agents/deep/ to run them.

Where agents come from

Agents come from three places.

The official catalog. It downloads on the first scan to ~/.agentgg/agentgg-agents/.
User-installed agents. A user adds a local agent file with agentgg agents add.
Per-scan agents. A single scan passes an agent, a folder, or a list file with -t.

agentgg-agents on GitHub

The catalog is open source under the MIT licence. Read the code, open an issue, or send a pull request.

Run one category

agentgg scan ./src -t agents/injection/

This command runs only the injection category.

Get started

Help

The three parts

Categories

Where agents come from

agentgg-agents on GitHub

Run one category

​The three parts

​Categories

​Where agents come from

agentgg-agents on GitHub

​Run one category

The three parts

Categories

Where agents come from

Run one category