Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/abhisekjha/pith/pith-debugnpx skills add abhisekjha/pith --skill pith-debuggit clone --depth 1 https://github.com/abhisekjha/pithWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/abhisekjha/pith/pith-debug)<a href="https://agentmods.dev/skills/abhisekjha/pith/pith-debug"><img src="https://agentmods.dev/badge/skills/abhisekjha/pith/pith-debug.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00044 | $0.00480 |
| Opus 5 | $0.00022 | $0.00240 |
| Sonnet 5 | $0.00009 | $0.00096 |
| Haiku 4.5 | $0.00004 | $0.00048 |
Grade A, and why
pith-debug scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Verify: curl -H "Authorization: Bearer $VALID_TOKEN" /api/me → 200 What it actually says
Debug format. Four fields. No prose. No preamble.
Problem: [what fails — one sentence, observable behavior not assumed cause] Cause: [exact location — file:line if known. The specific reason it fails.] Fix: [exact change — inline code, not a description of a change] Verify: [runnable command or test that confirms the fix worked]
Rules
- Each field: one line. Two lines max if critical detail requires it.
- Code inline in backticks. Block only if multi-line.
- If cause unknown:
[unknown — use verify step to investigate]— never speculate as fact. - Verify step must be a command or test, not "check if it works now."
- No "let me look at...", no "I see the issue is...", no trailing summary.
Example
Bad:
The issue seems to be related to how the token validation is being handled in the middleware layer. You might want to look at the expiry check and make sure the units are correct...
Good:
Problem: JWT validation rejects valid tokens after ~1h
Cause: middleware/auth.js:42 — `token.exp < Date.now()` — exp is seconds, now is ms
Fix: `token.exp * 1000 < Date.now()`
Verify: curl -H "Authorization: Bearer $VALID_TOKEN" /api/me → 200
Multi-issue
If multiple causes: number them. One Fix + Verify per cause.
Problem: login fails for new users
Cause 1: auth/register.js:18 — password hash missing await
Cause 2: db/users.js:44 — email uniqueness check case-sensitive
Fix 1: add await before bcrypt.hash(...)
Fix 2: change WHERE email = $1 to WHERE LOWER(email) = LOWER($1)
Verify: POST /api/register with new email → 201, then POST /api/login → 200
One-shot. Does not persist.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 51 lines · 44 tokens per session scan A 33df1ef2fee7
pith-debug is a skill published in the GitHub repository abhisekjha/pith (98 stars, last pushed 4mo ago), licensed MIT. It adds 44 tokens to every session and 480 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
craft-style
Builds a personal output style on hush's frame — the user's voice on the surface, hush's silence-and-structure mechanics copied verbatim underneath. Manages its own creations: lists them alongside stock Hush and edits them. A mechanical verifier confirms every invariant survived. Activation is hush:pick-style's job …
pick-style
Lists every output style available to this plugin — stock Hush and anything craft-style has built — and switches the active one. Activation swaps the chosen style into the plugin's own slot so it binds like stock, and hands back to stock on request. This skill owns the swap procedure; craft-style calls into it. Only…
s-continue
Cheaper and faster than /compact. Restores previous session context from Claude Code AND Codex transcripts by reading them directly — no LLM calls, no token cost. Also auto-loads a handoff written by /s-compact, if one exists. Triggers on "s-continue", "restore context", "what was I doing", "pick up where I left off"…
s-compact
Session handoff for the next session — write-side pair of /s-continue. Triggers on "s-compact", "session handoff", "handoff prompt", "hand off", "wrap up the session", "prep for next session". Distills what /s-continue cannot recover: subagent findings, tool-output numbers, and decisions that never entered the…
usage-view
Know exactly what you spent (Claude Code) or how much of your Codex limit you have used (Codex). Interactive HTML dashboard with token usage and, on Claude Code, cost breakdown and 5-hour window timeline across all sessions.
report-limit
Max plan hit the wall? Report your 5h window data — we're mapping the rate limit formula Anthropic won't publish.