Check C18 · agent surface family · severity HIGH · automatic · one of the 22 checks
The question this check asks: does this repository ship files that an AI coding agent will load at the start of a session and obey — before you have read them, and with no visual difference from anything a developer wrote?
CLAUDE.md, AGENTS.md, .cursorrules, .cursor/rules/*.mdc, .clinerules, .windsurfrules, .github/copilot-instructions.md, and the MCP and settings files under .mcp.json, .cursor/ and .claude/ are auto-loaded at session start and treated with near-system-prompt authority. The Cloud Security Alliance's ReadSecBench measured what that means: direct commands planted in repository text succeeded about 84% of the time, instructions two hops removed about 91%, and 93% of human reviewers missed the embedded attacks. The standard's rule is one line — fetch and read those files before starting an agent in the directory — and this check exists to tell you which files that means.
C18 reads the repository's file list and, for each file on that list, fetches its contents through the contents API. Each file is a row at severity HIGH with the note “auto-loaded by AI coding agents at session start — read before agent-ing”, and each row costs 0 points. The evidence note in the scoring table:
“77/80 top repos ship CLAUDE.md/AGENTS.md in 2026 — presence is not signal”
That produces a result worth explaining rather than hiding. Because the verdict follows the most severe row, a repository whose only finding is C18 reads REVIEW on the board — with a score of 100, and with the default personal policy set to allow, so the download proceeds and no decision page appears. The standard says read the file; the policy says it will not cost you the download; the board shows both. The weight lives in the three checks that read what is inside those files: C19 hidden Unicode (45 points, blocks), C20 MCP shell launch (30 points) and C21 credential redirect (30 points).
Not applicable in the usual sense — the row fires on every repository that has such a file, and in 2026 that is nearly every serious repository: 77 of the 80 most popular in our controls. The presence-only version of this check was demoted to zero points as a direct consequence of that measurement; before it, a HIGH-weighted presence row was pure noise that would have put a warning on React.
It reads the files on its list. A README that tells an agent what to do in plain prose — the ReadSecBench numbers above are about READMEs — is not an agent config file and is not read here. An instruction file under a name we do not know is not read until an extension update adds it. Your agent's own global configuration, outside the repository, is not the repository's and is never seen. And presence is all this row reports: what the files say is the job of C19, C20 and C21, and a file that contains a harmful instruction in ordinary visible text passes all three — the standard's advice to read them is not replaced by any check.
And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, or fetches made by AI agents outside the browser. It does not see the agent read the file; it sees the file before the download.
Without installing anything: look at the root of the repository and at .cursor/, .claude/ and .github/ for the names above, and read each one in full before you open an agent in the directory. With the GitHub CLI:
gh api repos/OWNER/REPO/git/trees/HEAD?recursive=1 --jq '.tree[].path' | grep -E '^(CLAUDE\.md|AGENTS\.md|\.cursorrules|\.clinerules|\.windsurfrules|\.github/copilot-instructions\.md|\.cursor/rules/.*\.mdc|\.mcp\.json|\.cursor/mcp\.json|\.claude/.*\.json)$'Then read them the way you would read a shell script someone handed you: as instructions that will be followed. If your agent supports disabling project-scoped configuration until you trust the folder, turn that on.
Why does the board show REVIEW with a score of 100? Because the standard and the policy disagree on purpose. The vetting standard grades an agent instruction file HIGH: read it before you start an agent in the directory. The scoring table weighs its presence at 0 points, because 77 of the 80 most popular repositories ship one, and the default policy lets the download proceed. A repository whose only finding is C18 therefore reads REVIEW at 100 on the board, and the gate does not stop it.
So what is the finding for? It names the files, so you know what an agent will read before you do, and it is the input to three checks that read the contents: hidden Unicode, an MCP configuration that launches a shell fetch, and a credential redirect. Those three carry the weight — 45, 30 and 30 points. Presence is the pointer; content is the signal.
Does RepoGates stop git clone? No. RepoGates gates browser-initiated downloads — Download ZIP and release-asset archives. It does not see git clone, package managers, curl, or fetches made by AI agents outside the browser — and it does not see the agent read the file; it sees the file before the download.
C19 Hidden Unicode — what is inside the file that a reviewer cannot see · C20 MCP shell-launch config — a command in the file that fetches and runs · C22 AI-agent provenance — a repository carrying instructions for an agent, and recommended by one.
Add RepoGates to Chrome Pricing
Numbers on this page: Cloud Security Alliance, ReadSecBench (success and reviewer-miss rates, as cited in the repository vetting standard); Phase 0 controls of 2026-08-14 (77 of 80 popular repositories); weights and actions from the product's scoring and policy tables.