diff --git a/AGENTS.md b/AGENTS.md
index dd4ba975b53..5e589d336dd 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -126,6 +126,7 @@
 
 ## GHSA (Repo Advisory) Patch/Publish
 
+- Before reviewing security advisories, read `SECURITY.md`.
 - Fetch: `gh api /repos/openclaw/openclaw/security-advisories/<GHSA>`
 - Latest npm: `npm view openclaw version --userconfig "$(mktemp)"`
 - Private fork PRs must be closed: