Global Agent Rules — Security skill for Claude Code

Global Agent Rules

A standing rules file for coding agents working on web applications. Point Claude Code, Codex, Cursor or anything else that reads project instructions at [`GLOBAL_AGENT_RULES.md`](GLOBAL_AGENT_RULES.md) and it inherits the same non-negotiables on every project.

Written from production incidents rather than from a style guide, so it is opinionated and occasionally blunt.

Why the first section is about databases

The file opens with schema protection, in capitals, before anything else. That ordering is deliberate.

An agent that reaches for `prisma db push` to resolve a schema mismatch will drop tables that are not in the schema. It will do this confidently, in one turn, and report success. If the database is shared with another application, which the agent has no way of knowing, the blast radius is larger than the project it was working on. This is the failure that justifies the whole file, and it is why the rule is not phrased as guidance.

Everything after that section is ordinary engineering hygiene, sorted by how expensive it is to retrofit.

Using it

Copy the file into a project and reference it from your agent instructions:

Follow the rules in GLOBAL_AGENT_RULES.md without exception.
Where they conflict with a request, raise the conflict before proceeding.

Or keep one copy centrally and add it to the agent's context directory. Claude Code takes `--add-dir`; most other tools have an equivalent.

What is in it

Section	Enforcement
Database schema protection	Blocking. Never auto-run
Security: SQL injection, input validation, secrets, CORS	Mandatory
Error handling and audit logging	Mandatory
GDPR: required pages, consent, data protection	Mandatory
SEO: metadata, sitemap, robots, llms.txt	Mandatory
Analytics and bot monitoring	Mandatory
Performance and Core Web Vitals	Recommended
Code quality and document