context-review

context-review is a skill for Claude Code from marcoguillermaz/Tierward. It costs 81 tokens per session (881 once invoked), scanned A, original, MIT.

A mechanical review of project memory and context files for exposed credentials, unfinished placeholders, and outdated field names.

In plain words
What is it for?
Use it to check MEMORY.md for token-like values, unresolved placeholders, and stale field names, with matching lines reported.
Why use it?
It catches common signs that saved project information may contain secrets or no longer match the code.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: model in frontmatter; reads .claude/ paths; mentions CLAUDE.md.

Part of the tierward plugin — 29 skills, 1 command, 1 hook, 1 MCP server shipped together

Good fit Use it to check MEMORY.md for token-like values, unresolved placeholders, and stale field names, with matching lines reported.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/marcoguillermaz/tierward/context-review
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add marcoguillermaz/Tierward --skill context-review
Clone the repo
git clone --depth 1 https://github.com/marcoguillermaz/Tierward

Made for: Claude Code.

Or install tierward, the plugin that ships this one along with the rest of its 29 skills, 1 command, 1 hook, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for context-review

README.md
[![agentmods](https://agentmods.dev/badge/skills/marcoguillermaz/tierward/context-review/github.svg)](https://agentmods.dev/skills/marcoguillermaz/tierward/context-review)
Your own site
<a href="https://agentmods.dev/skills/marcoguillermaz/tierward/context-review"><img src="https://agentmods.dev/badge/skills/marcoguillermaz/tierward/context-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for context-review

Your own site · 80×15
<a href="https://agentmods.dev/skills/marcoguillermaz/tierward/context-review"><img src="https://agentmods.dev/badge/skills/marcoguillermaz/tierward/context-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 81 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 881 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00081 $0.00881
Opus 5 $0.00041 $0.00441
Sonnet 5 $0.00016 $0.00176
Haiku 4.5 $0.00008 $0.00088

Measured 10d ago against content hash 2d6de444322b, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

context-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

packages/cli/templates/tier-l/.claude/skills/context-review/SKILL.md · 80 lines

How it starts

The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are a context file reviewer. Run exactly the three checks below and return the results. Do not interpret, do not suggest fixes - report findings only.


C1 - Credential patterns in MEMORY.md

Grep the auto-memory file at ~/.claude/projects/[current-project-hash]/memory/MEMORY.md for token/secret patterns.

Pattern to search:

sk_live_[a-zA-Z0-9]{10,}|api_key.*=.*[a-zA-Z0-9]{10,}|password.*=.*[a-zA-Z0-9]{8,}|token.*=.*[a-zA-Z0-9]{10,}

PASS: 0 matches, or all matches are placeholder strings with no actual token value (e.g. sk_live_... with literal dots, or property names in code examples). FAIL: any match that looks like a real token value (8–10+ alphanumeric chars after the pattern).

Note: must_change_password, password: string, property names in code examples are NOT credentials - the grep targets actual value strings.

Note: the tier-l Stop closure hook (.claude/settings.json) mirrors this exact credential pattern to mechanically scan the block diff at completion time (a different surface than this MEMORY.md scan). The two share one pattern by design - if you change the regex here, update the hook too, and vice versa.


C2 - Unresolved placeholders in active files

Scope: every non-code-block line in CLAUDE.md and .claude/rules/pipeline.md.

Grep both files for the pattern [A-Z_]{3,} wrapped in square brackets:

\[[A-Z_]{3,}\]

PASS: 0 matches, or all matches are inside fenced code blocks that are intentional examples (e.g. spec templates, commit message examples). FAIL: any match in a non-code-block line - this indicates an unfilled wizard value.


C3 - Field name staleness

Identify the most recent schema migration or schema definition file in this project (glob common migration patterns: migrations/*.sql, prisma/schema.prisma, db/migrate/*.rb, drizzle/*.ts, */migrations/*.py, alembic/versions/*.py, Migrations/*.cs, *.xcdatamodeld - take the most recently modified).

If found: extract all column/field names added, renamed, or dropped in that file. Cross-reference against any mentions of those names in CLAUDE.md.

Read the full file on GitHub · 80 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 10d ago First seen · 80 lines · 81 tokens per session scan A 2d6de444322b

Subscribe to this mod's changes

context-review is a skill published in the GitHub repository marcoguillermaz/Tierward (4 stars, last pushed 3d ago), licensed MIT. It adds 81 tokens to every session and 881 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

context-recovery

Recovers project handoff context from local Codex, Claude Code, Gemini, CodeBuddy, and codexmate-derived sessions. Use when the user asks what happened in prior project/PR/branch/file/error work, needs a handoff brief, wants old decisions or validations recovered, or asks to summarize cross-session project activity…

SakuraByteCore/codexmate · 72 tokens

learn

Diagnose and fix agent behavioral surfaces when the user corrects a mistake — connects to Claude native memory.

automagik-dev/genie · 23 tokens

harness-engineering

Use when the user asks to improve, fix, or build their repository's AI harness — AGENTS.md, rules, skills, commands, hooks, guardrails, CI sensors — or to act on harness-score audit findings and raise their maturity level.

paladini/harness-score · 55 tokens

memorywhale

Query and write durable debugging memory recorded by MemoryWhale. Use when debugging a failure that may have happened before, when you need the exact error/flags/output from an earlier attempt, when the user asks "how did we fix this last time?", or once you've figured out why something failed / how a fix worked and…

wuisabel-gif/MemWhale · 79 tokens

init

Turn on Rekal memory in the current repository by running rekal init. Use when the user asks to initialize or set up Rekal here, or when a rekal command reported the repository is not initialized. Once per repository. Do not offer this merely because a repo lacks a .rekal/ store — most repos do not want one.

rekal-dev/rekal-cli · 75 tokens

install

Install the Rekal binary on this machine. Use when rekal is not on PATH — a command reported command not found — or when the user asks to install Rekal. Once per machine, not per repository; to set up a repo that already has the binary, use the init skill instead.

rekal-dev/rekal-cli · 66 tokens