> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentgg.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> An agent is one markdown file with frontmatter and a prompt. Learn the three parts, the categories, and where agents come from.

An agent is one markdown file. It has YAML frontmatter and a prompt body. There are no execution modes.

## The three parts

| Part         | Key            | Purpose                                                |
| ------------ | -------------- | ------------------------------------------------------ |
| Precondition | `precondition` | Decides whether the agent runs on this repository.     |
| Where        | `where`        | Selects the files the agent scans.                     |
| Instructions | None           | Tells the agent what to find. This is the prompt body. |

## Categories

The agent library groups agents into categories. By default, every category runs except `deep/`. Point `-t` at a category folder to run only that category.

| Category            | What it checks                                                                                                      |
| ------------------- | ------------------------------------------------------------------------------------------------------------------- |
| `ai/`               | AI agent loops and tool-calling code, for unbounded loops and unsafe tool definitions.                              |
| `auth/`             | Authentication and authorization code, including sessions and access checks.                                        |
| `cloud/`            | Cloud function handlers and identity permissions on AWS, GCP, and Azure.                                            |
| `cryptography/`     | Cryptographic code, for weak algorithms, unsafe deserialization, and unchecked symlink writes.                      |
| `deep/`             | Broad-net variants of other agents. See the warning below.                                                          |
| `infrastructure/`   | Docker, Kubernetes, Terraform, and GitHub Actions configuration, plus sandbox runtimes that execute untrusted code. |
| `injection/`        | Injection flaws, including SQL, command, and cross-site scripting.                                                  |
| `logic/`            | Application logic, for race conditions, async bugs, and missing bounds checks.                                      |
| `misconfiguration/` | Configuration, including Cross-Origin Resource Sharing (CORS), caching, cookies, and feature flags.                 |
| `mobile/`           | Android and iOS code.                                                                                               |
| `smartcontract/`    | Solidity smart contracts, for access-control and reentrancy flaws.                                                  |

<Warning>
  `deep/` agents cast a wide net. They do not run by default. Add `-t agents/deep/` to run them.
</Warning>

## Where agents come from

Agents come from three places.

* **The official catalog.** It downloads on the first scan to `~/.agentgg/agentgg-agents/`.
* **User-installed agents.** A user adds a local agent file with `agentgg agents add`.
* **Per-scan agents.** A single scan passes an agent, a folder, or a list file with `-t`.

<Card title="agentgg-agents on GitHub" icon="github" href="https://github.com/agentgg-dev/agentgg-agents">
  The catalog is open source under the MIT licence. Read the code, open an issue, or send a pull request.
</Card>

## Run one category

```bash theme={null}
agentgg scan ./src -t agents/injection/
```

This command runs only the `injection` category.