I was recently adding Windows Support for some open source software on GitHub which is maintained by someone else. I gave 6.1-Sol all the instructions needed for creating a build, testing it on my machine, setting up an action on GitHub for CD, and it all did all of it very well BUT THEN IT AUTOMATICALLY OPENED A PR ON BEHALF OF ME WITHOUT ME ASKING FOR EXPLICIT PERMISSION??

That was incredibly embarrassing, I instantly converted the PR to a draft PR and added a comment that I would still need some time to verify everything locally. Ended up doing a few more commits to fix stuff. But damn, it opening a PR without my explicit permission was very scary.

I got tired of doing this and set up a /question skill that forbids the agent from doing anything that would modify my files. It makes it very clear what the intent of every prompt is.

Similarly, I have an /info skill that tells the agent to read my prompt, update any memories it thinks it should, then pass the turn.

That's been my experience as well. AGENTS.md just doesn't work. No matter how to-the-point and short, or detailed I keep it. Sending something what you have mentioned in the current prompt works much better. I thought of tweaking it around with a extension/hook or so. But then I decided it was better to use a few text-expansions.

I just append « talk », it works pretty well.

I suffix the message with "Asking, not questioning."