On March 31, 2026, Anthropic accidentally exposed the full source code of Claude Code through a JavaScript source map bundled in a public npm package. Within hours, the codebase was mirrored to GitHub and forked thousands of times. Within 24 hours, threat actors were distributing malware through fake "leaked Claude Code" repositories.
The attack wasn't sophisticated. It just exploited a simple truth: most people can't tell a safe AI tool from a dangerous one.
The trust problem in AI tools
If you've browsed GitHub, Reddit, or Gumroad for AI tools, you've seen the pattern. Someone shares a "Claude setup," an "AI agent blueprint," or a "system prompt pack." You download it. You paste it into Claude. You have no idea what it actually does.
Maybe it's fine. Maybe it's sending your API key to a third party. Maybe it's instructing Claude to embed tracking information in its outputs. You wouldn't know because most AI tool sellers don't show you what's inside.
This isn't hypothetical. Check Point Research found zero-click attack vectors in AI tool repositories. Zscaler documented rotating lure operations impersonating 25+ software brands. The malware campaigns are real, and they specifically target people who download AI tools.
What "open instructions" means
Every Kumo product publishes its full instruction set on GitHub. Not a summary. Not a description. The actual files.
When you buy a Claude Project Kit from us, the project-instructions.md file — the exact text Claude receives as its custom instructions — is published in our Open Instructions repository. You can read every line before you spend a dollar.
Here's what that means in practice:
- You can verify that the instructions don't contain obfuscated prompts, encoded strings, or hidden behaviors
- You can confirm there are no network calls, no API endpoints, no data exfiltration
- You can compare the files you download against the published versions to make sure nothing was changed
- You can share the instructions with anyone who wants to review them
What we publish vs. what you're paying for
We publish the instructions and the trust document (WHAT-THIS-DOES.md) for every product. That's the transparency layer — it's what tells Claude how to behave.
What you're paying for is the rest of the kit: the onboarding templates that make your first session feel personal, the session formats that give structure to your interactions, the reference material that makes Claude genuinely useful in its domain, and the setup guide that makes it take 3 minutes instead of 3 hours.
The instructions are free to read. The product is the work of getting it all right.
The bar should be higher
Anthropic explicitly states that it doesn't manage or audit community-built tools. That's reasonable — they can't vet every tool built on their platform. But it creates a trust vacuum. When the platform doesn't verify, the seller should.
We think transparency is the minimum bar for AI tools you trust with personal thoughts, dietary information, financial data, or anything else you wouldn't post publicly. If a seller won't show you what their AI is told to do, ask yourself why.
What to look for in any AI tool
Whether you buy from us or not, here's what to check before using any AI tool, prompt pack, or Claude configuration:
- Can you read the instructions? If the seller won't show you what Claude is told, skip it.
- Does it make network calls? Plain text files that you paste into Claude don't need internet access. If a tool requires installing something or connecting to an external service, understand why.
- What data does it access? Claude Projects run inside your account. A system prompt shouldn't need anything outside that boundary.
- Is it clear what it does NOT do? Good tools tell you their limits. "This is not therapy." "This is not medical advice." "We never see your conversations." Vagueness is a red flag.
Our commitment
Every Kumo product will continue to publish its full instruction set on GitHub. If we change the instructions, the published version updates too. If we add a new product, its instructions go public before the first sale.
We don't think this is radical. We think this is what baseline trust looks like.
Check the Open Instructions repository to see for yourself. And if you find something you think should be different, email us at hello@kumos.dev. We'll fix it.