Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/benmarte/codemunch/fetchnpx skills add benmarte/codemunch --skill fetchgit clone --depth 1 https://github.com/benmarte/codemunchWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00062 | $0.00958 |
| Opus 5 | $0.00031 | $0.00479 |
| Sonnet 5 | $0.00012 | $0.00192 |
| Haiku 4.5 | $0.00006 | $0.00096 |
Grade B, and why
fetch scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
cat .claude/codemunch/index.json | python3 -c " How it starts
The opening of the file, as written. The whole thing — 117 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Fetch Skill
Retrieve the exact source of a named symbol. Read 20 lines instead of 800.
Usage
Called with a symbol name, e.g.: validateToken, AuthService, getUserById, Invoice
Step 1 — Look up in index
# Read the index
cat .claude/codemunch/index.json | python3 -c "
import json, sys
idx = json.load(sys.stdin)
name = '$SYMBOL_NAME'
matches = [s for s in idx['symbols'] if s['name'].lower() == name.lower()]
print(json.dumps(matches, indent=2))
" 2>/dev/null
# Or with jq if available
jq --arg n "$SYMBOL_NAME" '[.symbols[] | select(.name | ascii_downcase == ($n | ascii_downcase))]' \
.claude/codemunch/index.json 2>/dev/null
If no index exists: the staleness-gate skill will have already built it before this skill runs.
If multiple matches (e.g. overloaded methods or same name in different files), show a disambiguation list and ask which one.
Step 2 — Extract the symbol source
Use the start_line and end_line from the index entry to read only those lines:
FILE="src/auth/tokens.ts"
START=142
END=163
# Add a few lines of context before (for decorators, comments, annotations)
CONTEXT_BEFORE=3
ACTUAL_START=$((START - CONTEXT_BEFORE))
[ $ACTUAL_START -lt 1 ] && ACTUAL_START=1
sed -n "${ACTUAL_START},${END}p" "$FILE"
Token count for this operation: ~20-40 tokens Token count for reading the full file: ~5,000-15,000 tokens
Step 3 — Enrich with LSP (when available)
If LSP is configured for this language, additionally fetch:
Hover information — type signature, documentation:
Use Claude Code's /lsp tool:
textDocument/hover
position: { line: START_LINE, character: 0 }
Type signature — already in index if built with LSP, but refresh if stale
Find references count — how many places call this symbol:
Use /lsp:
textDocument/references (just count, don't fetch all)
Step 4 — Display
Show the symbol in this format:
📍 validateToken [function] src/auth/tokens.ts:142-163
Engine: LSP | Signature: validateToken(token: string): Promise<User | null>
Container: AuthService | References: 14
─────────────────────────────────────────
[source code lines 139-163]
─────────────────────────────────────────
Tokens used: ~35 (vs ~8,400 to read full file — 99.6% savings)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 117 lines · 62 tokens per session scan B 56de8370058c
fetch is a skill published in the GitHub repository benmarte/codemunch (7 stars, last pushed 5mo ago), licensed MIT. It adds 62 tokens to every session and 958 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
karting-advisor
KartSan — AI karting coach for youth racers (7-14) in Rotax Micro/Mini/Junior MAX. Bilingual EN/PT. Analyzes MyChron 5/5S/6 telemetry, TRAX data, Race Studio 3 exports, GPS trails, and screenshots. Builds interactive dashboards with track maps and overlays. Covers technique, setup, gearing, tires, jetting, Rotax…
r3f-animation
React Three Fiber animation - useFrame, useAnimations, spring physics, keyframes. Use when animating objects, playing GLTF animations, creating procedural motion, or implementing physics-based movement.
workflow
Professional AI programming assistant with structured workflow (Research -> Ideate -> Plan -> Execute -> Optimize -> Review) for developers.
golden-rss
Use when testing the rss golden build.
agile-product-owner
../../../product-team/agile-product-owner/skills/agile-product-owner/SKILL.md.
agent-memory
../../../engineering/agent-memory/skills/agent-memory/SKILL.md.