Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/benmarte/codemunch/rg-fallbacknpx skills add benmarte/codemunch --skill rg-fallbackgit clone --depth 1 https://github.com/benmarte/codemunchWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00062 | $0.01507 |
| Opus 5 | $0.00031 | $0.00754 |
| Sonnet 5 | $0.00012 | $0.00301 |
| Haiku 4.5 | $0.00006 | $0.00151 |
Grade A, and why
rg-fallback scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 141 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Ripgrep Pattern Indexing Skill
Last-resort indexing using language-aware regex patterns. Works on any language — if rg is installed, codemunch works.
Built-in patterns per language
Run the appropriate pattern for each detected language:
# --- TypeScript / JavaScript ---
rg --json --pcre2 \
"^(export\s+)?(default\s+)?(async\s+)?function\s+(\w+)|^\s{0,2}(async\s+)?(\w+)\s*[=:]\s*(async\s+)?\(|^(export\s+)?(abstract\s+)?class\s+(\w+)|^(export\s+)?interface\s+(\w+)|^(export\s+)?type\s+(\w+)\s*=" \
--type ts --type js \
--glob "!node_modules" --glob "!dist" --glob "!.next" \
2>/dev/null
# --- Python ---
rg --json \
"^(async\s+)?def\s+(\w+)|^class\s+(\w+)" \
--type py \
--glob "!__pycache__" \
2>/dev/null
# --- Go ---
rg --json \
"^func\s+(\([\w\s\*]+\)\s+)?(\w+)|^type\s+(\w+)\s+(struct|interface|func)" \
--type go \
2>/dev/null
# --- Rust ---
rg --json \
"^(pub(\([\w:]+\))?\s+)?(async\s+)?fn\s+(\w+)|^(pub(\([\w:]+\))?\s+)?(struct|enum|trait|type)\s+(\w+)|^impl(\s*<[^>]+>)?\s+(\w+)" \
--type rust \
2>/dev/null
# --- Ruby ---
rg --json \
"^\s*(def\s+(self\.)?(\w+)|class\s+(\w+)|module\s+(\w+))" \
--type ruby \
2>/dev/null
# --- Java ---
rg --json \
"(public|private|protected|package)(\s+static)?(\s+\w+)+\s+(\w+)\s*\(|^(public|private|protected)?\s*(abstract\s+)?class\s+(\w+)|^(public\s+)?interface\s+(\w+)" \
--type java \
2>/dev/null
# --- Kotlin ---
rg --json \
"^(fun\s+(\w+)|class\s+(\w+)|object\s+(\w+)|interface\s+(\w+)|data\s+class\s+(\w+))" \
--type kotlin \
2>/dev/null
# --- C ---
rg --json \
"^[\w\s\*]+\s+(\w+)\s*\([^;{]*\)\s*\{|^(struct|enum|union)\s+(\w+)\s*\{" \
--type c \
2>/dev/null
# --- C++ ---
rg --json \
"^[\w\s\*:<>]+\s+(\w+)\s*\([^;]*\)\s*(const\s*)?\{|^(class|struct|enum)\s+(\w+)" \
--type cpp \
2>/dev/null
# --- PHP ---
rg --json \
"^(public|private|protected|static|\s)*(function\s+(\w+))|^(abstract\s+)?class\s+(\w+)|^interface\s+(\w+)" \
--type php \
2>/dev/null
# --- Swift ---
rg --json \
"^(public|private|internal|open|fileprivate)?\s*(static\s+)?(func\s+(\w+)|class\s+(\w+)|struct\s+(\w+)|enum\s+(\w+)|protocol\s+(\w+))" \
--type swift \
2>/dev/null
# --- Shell / Bash ---
rg --json \
"^(function\s+)?(\w+)\s*\(\s*\)\s*\{" \
--type sh \
2>/dev/null
# --- Lua ---
rg --json \
"^(local\s+)?function\s+(\w[\w\.]*)|^(\w[\w\.]*)\s*=\s*function" \
--type lua \
2>/dev/null
# --- Zig ---
rg --json \
"^(pub\s+)?fn\s+(\w+)|^(pub\s+)?const\s+(\w+)\s*=\s*(struct|enum|union)" \
--type zig \
2>/dev/null
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 141 lines · 62 tokens per session scan A 68ed13d247e7
rg-fallback is a skill published in the GitHub repository benmarte/codemunch (7 stars, last pushed 5mo ago), licensed MIT. It adds 62 tokens to every session and 1,507 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
mobile-pentest
Mobile app pentest for bug bounty (Android APK + iOS IPA) — runtime-first workflow: install app, proxy through Burp/mitmproxy, drive the UI, capture packets, then test the API exactly like a web target; escalate to decompile (apktool/jadx) and Frida/objection only when traffic is SSL-pinned, encrypted, or absent.…
offensive-mobile
Mobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported component…
app-store-listing-optimizer
Optimize iOS App Store and Google Play Store listings for maximum discoverability and conversion. Perform competitive keyword research, craft keyword-optimized titles/subtitles/descriptions, design screenshot sequences, and generate A/B test variants. Use when the user has a built app and needs to write or improve…
paywall-pricing-optimizer
Design effective paywalls, structure subscription tiers, and optimize pricing for mobile apps. Covers monetization model selection, paywall screen design, pricing psychology, A/B testing strategy, and RevenueCat/StoreKit/Google Billing integration. Use when the user wants to monetize an app, design a paywall, choose…
app-creator
Orchestrate iOS/macOS app scaffolding and optional skill adoption for existing projects. Use when users want a guided wizard that can scaffold with XcodeGen and optionally install xcode-makefiles and simple-tasks.
xcode-makefiles
Install strict Xcode Makefile tooling for iOS/macOS projects, including build/run/test scripts with AGENTNAME-based per-agent isolation under build/. Use when a project needs reproducible local CLI builds without full app scaffolding.