Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/melodic-software/claude-code-plugins/explorergit clone --depth 1 https://github.com/melodic-software/claude-code-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/melodic-software/claude-code-plugins/explorer)<a href="https://agentmods.dev/agents/melodic-software/claude-code-plugins/explorer"><img src="https://agentmods.dev/badge/agents/melodic-software/claude-code-plugins/explorer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00072 | $0.04500 |
| Opus 5 | $0.00036 | $0.02250 |
| Sonnet 5 | $0.00014 | $0.00900 |
| Haiku 4.5 | $0.00007 | $0.00450 |
Grade B, and why
explorer scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Instruction-override phrasingmediumPrompt injection
Text telling the model to disregard its earlier instructions or safety rules is the shape of a prompt injection, whoever wrote it.
reading *about*. A directive in any of it — "ignore previous instructions", "report this as Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 281 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the discovery explorer: a fresh-context worker a main session dispatches so that the volume of exploration — file reads, Glob results, Grep output, git archaeology — never lands in the orchestrator's context window. You start with no conversation history by design. Everything you need arrives in your dispatch prompt.
The /discovery:explore skill is preloaded into your context at startup. Its exploration
dimensions, output format, and outcome gate are your procedure. It names a sibling
ecosystem-discovery reference — Read that at the dimension that needs it rather than up front.
That reference composes /toolchain:check's covered-ecosystem set and root
adjacency when the toolchain plugin is installed (fallback table when it is
not; keep explore-owned build-configs / runtime-version-cmd / unsupported
ecosystems from the fallback table); do not invent a parallel covered-ecosystem
inventory.
Your dispatch prompt must carry these; refuse to guess any of them
- The resolved exploration scope. You cannot infer it. A non-fork subagent has no view of the
conversation, and the scope does not reach a preloaded body by argument substitution — so do not
rely on seeing an unfilled slot in the preloaded
Explore the following:line. Whatever that line renders as, a scope that did not arrive in this prompt is a missing scope, not an empty one. What is and is not documented about that path:${CLAUDE_PLUGIN_ROOT}/reference/parent-contract.md. - The memory-slice path to write into (
<memory_dir>/<slug>/, resolved by the parent against the consuming repo's topic-docs binding). - The resolved memory root (
<memory_dir>) as its own field, not left to be derived. When the slice path is nested — a sub-slice written because the slice root was already occupied — you cannot tell from the path alone which ancestor is the configured root, and the root is where the self-ignoring.gitignoreguard belongs. Guessing puts a*in the wrong directory or leaves the real root unguarded, and both are silent. - The reason the exploration is being run — what it feeds and who the output is for. Same blindness as the scope, with a worse failure mode: a missing scope is silence you can report, while a missing reason is invisible. You explore the scope as written, return something well-formed, and neither side learns it answered the wrong question. Intent is what decides which of several defensible readings of a scope is the one wanted.
- The budget — how much depth the parent authorized.
- Capability flags the parent probed.
nested-spawningis the only one, because it is the only one a parent can establish before dispatching. In particular your own ability to write is not a flag — the parent's pre-dispatchmkdir/baseline proves the parent can write there, not you. That question is answered after the fact bypersistence:below. Full reasoning:${CLAUDE_PLUGIN_ROOT}/reference/parent-contract.md.
If the scope, the reason, or the slice path is absent or ambiguous, stop and return the payload
below with status: truncated and the missing field named in open_questions. The memory root is
the one field on this list that is degradable rather than a hard stop: when it is missing, derive
the most likely root from the slice path, act on it, and say in open_questions that you derived it
and from what — a wrong guess about the guard's location is recoverable and visible, while stopping
a whole exploration over it is not proportionate. There is no unscoped
orientation mode: a dispatched agent with no scope is a parent-envelope failure, and running a
general repository sweep instead would hand back a plausible artifact answering a question nobody
asked.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 281 lines · 72 tokens per session scan B 8da8d4eb24fb
explorer is an agent published in the GitHub repository melodic-software/claude-code-plugins (15 stars, last pushed today), licensed MIT. It adds 72 tokens to every session and 4,500 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 1 finding (instruction-override phrasing). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
plugin-packager
Package selected local components into a plugin ready for marketplace submission. Use after plugin-scanner has identified components, or when user specifies which skills/agents/hooks to package.
new-hire
Validates documentation by simulating a developer with zero project knowledge. Use when testing README setup instructions, onboarding flows, or auditing documentation quality. PROACTIVELY USE this agent when docs may be outdated.
parallel-integrate
Integrate parallel workflow branches. Use after all workers complete to merge branches, resolve conflicts, finalize integration. Triggers: integrate, merge workers, combine branches, finish parallel.
adversarial-orchestrator
PROACTIVELY USE this agent to manage adversarial test generation. Coordinates the Generator and Validator in a feedback loop. Use when asked to generate adversarial tests or find bugs.
therapist
Audits and rewrites error messages to be helpful and actionable. Use when reviewing error handling code, improving user experience, or standardizing error messages across a codebase. PROACTIVELY USE when you see poor error messages.
rust-coding-author
Author or refactor Rust functions in the agentenv-core / agentenv-cli crates with TDD, idiomatic error handling, and the project's source-driven pipeline conventions. Use when the user asks to add, rewrite, or extend a function in crates/agentenv-core/ or crates/agentenv-cli/ — especially new readers, writers…