agentmods.dev

pith-review

pith-review is a skill for Claude Code from abhisekjha/pith. It costs 37 tokens per session (453 once invoked), scanned A, original, MIT.

A one-pass code-review skill that reports issues one line at a time using labels such as bug, security problem, performance problem, or minor style issue.

In plain words
What is it for?
Use it to review a pull request, file, or function and receive precise findings with line numbers, severity labels, and specific fixes.
Why use it?
It produces a compact review without a summary, making the output easy to scan and apply directly to a file or change.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin.

Part of the pith plugin — 12 skills, 4 commands, 4 hooks shipped together

not rated 97repo 6mo ago A scan 37 tokens original MIT

Good fit Use it to review a pull request, file, or function and receive precise findings with line numbers, severity labels, and specific fixes.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/abhisekjha/pith/pith-review
View source ↗ abhisekjha/pith abhisekjha.com.np
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add abhisekjha/pith --skill pith-review
Clone the repo
git clone --depth 1 https://github.com/abhisekjha/pith

Made for: Claude Code.

Or install pith, the plugin that ships this one along with the rest of its 12 skills, 4 commands, 4 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for pith-review

README.md
[![agentmods](https://agentmods.dev/badge/skills/abhisekjha/pith/pith-review/github.svg)](https://agentmods.dev/skills/abhisekjha/pith/pith-review)
Your own site
<a href="https://agentmods.dev/skills/abhisekjha/pith/pith-review"><img src="https://agentmods.dev/badge/skills/abhisekjha/pith/pith-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for pith-review

Your own site · 80×15
<a href="https://agentmods.dev/skills/abhisekjha/pith/pith-review"><img src="https://agentmods.dev/badge/skills/abhisekjha/pith/pith-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 37 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 453 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00037 $0.00453
Opus 5.5 $0.00015 $0.00181
Sonnet 5.5 $0.00007 $0.00091
Haiku 4.5 $0.00004 $0.00045

Measured 2mo ago against content hash cd9454aa1bcc, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

pith-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/pith-review/SKILL.md · 49 lines

What it actually says

One line per issue. Exact format:

L<line>: <SEVERITY> <what is wrong>. Fix: <exact change>.

Severity levels

  • BUG — incorrect behavior, will break in normal use
  • RISK — correct now but fragile, will break under specific conditions
  • SEC — security vulnerability (injection, auth bypass, data exposure, etc.)
  • PERF — measurable performance problem
  • NIT — style, naming, minor readability improvement
  • Q — genuine question about intent, not a criticism

Rules

  • One line per issue. Hard limit.
  • No preamble. No "Overall this looks good." No trailing summary.
  • If no issues: single line No issues found.
  • File prefix only when reviewing multiple files: auth.ts L42: BUG ...
  • Fix must be specific. Not "handle this better" — the actual change.
  • SEC issues: describe the attack vector, not just "this is insecure."

Examples

L42:  BUG  token.exp compared in wrong unit (seconds vs ms). Fix: token.exp * 1000 < Date.now()
L87:  SEC  /auth endpoint has no rate limiting — brute-force viable. Fix: add express-rate-limit, max 10/min per IP
L103: RISK db.query() not wrapped in try/catch — uncaught rejection crashes server. Fix: wrap, return 500
L118: NIT  variable named `data` — too generic. Fix: rename to `userProfile`
L201: Q    Why is this cached for 24h? Stale user data seems risky here.

For a file with no path given

Start each line with the line number only: L42: BUG ...

For multiple files

Prefix with filename: routes/auth.ts L42: BUG ...

One-shot. Does not persist.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2mo ago First seen · 49 lines · 37 tokens per session scan A cd9454aa1bcc

Subscribe to this mod's changes

pith-review is a skill published in the GitHub repository abhisekjha/pith (97 stars, last pushed 6mo ago), licensed MIT. It adds 37 tokens to every session and 453 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Claude CodeCode reviewanthropicclaude-code-pluginllm-toolstoken-optimization
Related

pith-review compared with skills from other repositories

pith-review next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
pith-reviewabhisekjha/pithSkill976mo agoMITA37Claude Code
security-reviewwaybarrios/opencode-power-packSkill5514d agoMITA64Claude Code
huggingface-llm-trainerwaybarrios/opencode-power-packSkill5514d agoMITA65Claude Code
feature-devwaybarrios/opencode-power-packSkill5514d agoMITA62Claude Code
huggingface-vision-trainerwaybarrios/opencode-power-packSkill5514d agoMITA48Claude Code
huggingface-paper-publisherwaybarrios/opencode-power-packSkill5514d agoMITA42Claude Code
semgrep-rule-variant-creatorwaybarrios/opencode-power-packSkill5514d agoMITA50Claude Code