agentcheck: your CLAUDE.md is an instruction file nobody reviews. Scan it.
Repositories now ship instruction files for AI coding agents: CLAUDE.md, AGENTS.md, .cursor/rules, .windsurf/rules, .github/copilot-instructions.md, MCP configs. Your AI reads and follows every one of them. Your reviewers barely look at them. That gap is already being exploited. Pillar Security showed how a poisoned rule file makes Copilot and Cursor write backdoored code, with the payload hidden in invisible Unicode that stays invisible in diffs and in GitHub's PR view. AgentSeal scanned 50 pub
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.