Borrowing it
Nothing to install: this file belongs to lesterchan/gamerz-file-explorer. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/lesterchan/gamerz-file-explorer/master/CLAUDE.mdgit clone --depth 1 https://github.com/lesterchan/gamerz-file-explorerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/lesterchan/gamerz-file-explorer/claude-md)<a href="https://agentmods.dev/instructions/lesterchan/gamerz-file-explorer/claude-md"><img src="https://agentmods.dev/badge/instructions/lesterchan/gamerz-file-explorer/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/lesterchan/gamerz-file-explorer/claude-md"><img src="https://agentmods.dev/badge/instructions/lesterchan/gamerz-file-explorer/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01500 | $0.01500 |
| Opus 5 | $0.00750 | $0.00750 |
| Sonnet 5 | $0.00300 | $0.00300 |
| Haiku 4.5 | $0.00150 | $0.00150 |
Grade A, and why
gamerz-file-explorer CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 84 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
Guidance for working in the GaMerZ File Explorer codebase.
What this is
A single-directory PHP web app (no framework, no Composer, no database) that lists, searches, views, and downloads the contents of a configured root folder — styled like Windows Explorer. Procedural PHP, distributed as a set of files users drop into a web directory.
Layout
| File | Role |
|---|---|
config.php |
Site constants (GFE_ROOT_DIR, GFE_ROOT_URL, GFE_URL, names, toggles). Edited per-install. |
settings.php |
Ignore lists ($ignore_files, $ignore_ext, $ignore_folders), inline-view lists ($text_ext/$image_ext/$video_ext/$audio_ext), extension→label/icon map, and GFE_VERSION. |
functions.php |
Shared helpers and the HTML templates (template_header, template_footer, breadcrumbs, display_error, listing/sort helpers). |
index.php |
Directory listing. Reads $_GET['dir'], by, order. |
search.php |
Search UI + results. Reads $_GET['search'], in, by, order. |
view.php |
View (text/image/PDF/video/audio) or download a file. Reads $_GET['file'], dl. |
404.php |
Error page. |
Every entry point starts with require 'config.php'; require 'settings.php'; require 'functions.php'; in that order.
Conventions
- PHP 8.1+,
declare(strict_types=1), PSR-12, 4-space indent, short array syntax[],snake_casefunctions/vars,GFE_-prefixedSCREAMING_SNAKEconstants,' . $x . 'concatenation spacing throughout..editorconfigandphpcs.xml.distare authoritative. settings.phpreturns a settings array; entry points do$settings = require 'settings.php';and pass it into thefunctions.phphelpers. There is no shared global state.- When outputting any dynamic value (filenames, paths, search terms, request values),
escape it at the point of output with
esc($value)— thefunctions.phphelper forhtmlspecialchars($value, ENT_QUOTES, 'UTF-8')(the only place that raw call should appear). Pass raw values tourl()— it URL-encodes the path internally, soesc()the display copy rather than the raw value.url()can also return a?by=&order=query string (a non-default sort), so alsoesc()its result wherever it lands in markup (anhref), not just the display copy. urldecode()the incomingdir/filerequest values before using them and before the traversal check inindex.php/view.php— reject any.or..path segment (explode('/')thenin_array) plus a literal//, so a bare..with no trailing slash can't list the parent of the web root. Nice-URLs encode a space as+, which the web server passes as%2B; skipping the decode breaks paths with spaces (the 3.0.0 regression). Keep that decode-then-check order for any new path input.settings.phpignore lists keep internal files (config.php,functions.php, the Composer/PHPStan/PHPCS/PHPUnit files, theREADME/LICENSE/AGENTS.md/CLAUDE.mdmetadata, …) out of listings; add new internal files there. Hiding is not access control — the.htaccess/Nginx deny rules and the CLI-only guard intests/are what stop the web server serving dev/tooling files. Keep them in place.- Frontend is Bootstrap 5.3 + Font Awesome 6 loaded from cdnjs with SRI hashes, no jQuery.
If you bump a CDN version, update its
integrityhash too. - Custom styling and behaviour live in
resources/style.cssandresources/script.js, linked fromfunctions.phpwith a?v=GFE_VERSIONcache-buster (resources/is served statically and is in$ignore_folders). The stylesheet defines light/dark design tokens keyed offdata-bs-themeand maps Font Awesome classes (.fa-file-pdf,.fa-folder, …) to category CSS variables; the script wires the three-way theme switch (data-gfe-theme, auto/light/dark, persisted tolocalStorage), the clickable rows, and highlight.js. The one inline script is the tiny theme-detection snippet in<head>that setsdata-bs-themebefore paint to avoid a flash — keep it inline. Keepstyle.csscomment-free and bumpGFE_VERSIONfor visible style changes (so the cache-buster updates). view.phpembeds PDFs inline with<object>(with an open/download fallback for browsers that can't render it), and video/audio with<video>/<audio>. The PDF<object>needs the site CSP to allowobject-src 'self';<video>/<audio>rely onmedia-src. Only browser-playable$video_ext/$audio_extembed; everything else downloads.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 84 lines · 1,500 tokens per session scan A d3cc35c2f550
gamerz-file-explorer CLAUDE.md is an instructions file published in the GitHub repository lesterchan/gamerz-file-explorer (23 stars, last pushed 1mo ago), licensed MIT. It adds 1,500 tokens to every session, about $0.0075 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
spec-kit AGENTS.md
AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.