Report · marked 26 Aug 2026
danielmiessler/SecLists
An agent is close to flying blind in this repository.
PHP · 73,079 stars · 6,272 files · branch master
34
/100
D
Instructions
3/27Whether the repo tells an agent how to behave before it starts guessing. Losing marks on agent instruction file and instruction quality.Setup
0/14Whether an agent can install the project and get it running without a human. Losing marks on deterministic install and discoverable commands.Verification loop
8/25Whether an agent can check its own work. This is the category that most decides whether agent output is trustworthy. Losing marks on tests exist and test command is discoverable.Context economy
15/20Whether the repo fits in a context window, or fights it. Losing marks on repository weight.Navigability
7/10How quickly anything new can orient itself. Losing marks on written documentation and repository description.
Higher is better. Accent marks what is costing you most.
Fix these first
01
Agent instruction file
Add an AGENTS.md at the root: what the project is, how to install, how to run, how to test, and the two or three conventions a newcomer always gets wrong.
02
Instruction quality
Instructions earn their keep by naming exact commands. 'Run the tests with `pnpm test`' beats three paragraphs of philosophy.
03
Test command is discoverable
Add a `test` script or a `test` target that runs the whole suite with no arguments. The convention is the interface — an agent tries `npm test` and `make test` before it tries reading your CI config.
The full marking
Every deduction below names the file or setting it came from.
Instructions 3/27 F
Whether the repo tells an agent how to behave before it starts guessing.
✗Agent instruction file
0/12
None found. Every agent that opens this repo starts from zero.
Add an AGENTS.md at the root: what the project is, how to install, how to run, how to test, and the two or three conventions a newcomer always gets wrong.
Looked for AGENTS.md, CLAUDE.md, .github/copilot-instructions.md, .cursorrules
✗Instruction quality
0/12
Nothing to judge, since there are no instructions.
Instructions earn their keep by naming exact commands. 'Run the tests with `pnpm test`' beats three paragraphs of philosophy.
✓README as an entry point
3/3
README has a clear getting-started section.
Setup 0/14 F
Whether an agent can install the project and get it running without a human.
✗Deterministic install
0/6
No lockfile. An agent installing dependencies may not get what CI got.
Commit the lockfile your package manager generates. Without it, an agent's install and your install are different builds, and 'works on my machine' becomes unfalsifiable.
✗Discoverable commands
0/6
No declared commands. An agent has to infer how to build and run this from the file tree.
Declare the handful of commands that matter in package.json scripts, a Makefile, or a justfile. Naming them turns guesswork into a lookup.
–Environment config
n/a
Not applicable — this reads as a library, with no environment to configure.
✗Pinned runtime version
0/2
No pinned runtime version.
Add a .nvmrc, .python-version, or equivalent so the agent's toolchain matches yours.
–Reproducible environment
n/a
Not applicable — a library doesn't need a container to be worked on.
Verification loop 8/25 D
Whether an agent can check its own work. This is the category that most decides whether agent output is trustworthy.
✗Tests exist
4/8
1 test file against 65 source files.
Coverage is thin enough that an agent can break real behavior and still see green.
e.g. Fuzzing/extension-test.txt
✗Test command is discoverable
0/7
There's no obvious way to run the tests. Even if tests exist, an agent won't reliably find the entry point.
Add a `test` script or a `test` target that runs the whole suite with no arguments. The convention is the interface — an agent tries `npm test` and `make test` before it tries reading your CI config.
✓Continuous integration
4/4
8 GitHub Actions workflows define what "passing" means.
✗Lint and format rules
0/3
No linter or formatter config. Style is tribal knowledge, so agent output will drift from yours.
A formatter config is the cheapest way to stop reviewing whitespace in agent diffs. It moves style from opinion to a command.
✗Static type checking
0/3
No static type checking.
A type checker gives an agent an error message instead of a runtime surprise. It's the second-fastest feedback loop after the compiler.
Context economy 15/20 B+
Whether the repo fits in a context window, or fights it.
✓No committed build output
6/6
No generated directories committed.
✓.gitignore hygiene
3/3
.gitignore covers 5 patterns.
✓File sizes fit in context
6/6
No source file is large enough to crowd out a context window.
✗Repository weight
0/5
About 3540MB checked out. Large enough that cloning and searching are both slow.
Large binaries and vendored trees slow every operation an agent performs. Git LFS or a separate assets repo keeps the working tree navigable.
Here is your AGENTS.md
Drafted from what is actually in this repository: the install
command from your lockfile, the commands you already declare, your real directory layout. Anything
marked TODO needs a person. Save it at the root as AGENTS.md.
# AGENTS.md SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more. ## Setup ``` # TODO: the install command. No lockfile was found, so this could not be inferred. ``` ## Commands ``` # TODO: nothing declares a build or test command, so an agent has to guess. # This is the single most valuable section of this file. Fill it in. ``` ## Layout - `Web-Shells/` 37 source files - `Miscellaneous/` 5 source files - `Discovery/` 2 source files - `Payloads/` 2 source files - `Fuzzing/` 1 source file ## Conventions - Tests live alongside the code they cover, following `Fuzzing/extension-test.txt`. - CI defines what passing means. See `.github/workflows/readme-updater.yml`, and keep it green. - TODO: add the two or three conventions a newcomer always gets wrong here. ## Gotchas - No lockfile is committed, so an install here may not match what CI produced. --- Drafted by agentreadme.com from what is in this repository. Everything marked TODO needs a human. Check it in as AGENTS.md at the root.
Open the raw markdown
or
curl -o AGENTS.md agentreadme.com/draft/danielmiessler/SecLists.md
Show the mark
The badge re-checks daily, so it keeps up as the repository changes. Use mark again to force it now.
[](https://agentreadme.com/danielmiessler/SecLists)Other PHP repositories, marked
Think this mark is wrong?
Every deduction above names the file it came from, so this can be settled by looking. If a check missed something, that is a rule worth fixing.