pstack-claude is a set of opinionated coding-agent skills and workflows ported from Cursor to Claude Code, Codex, Pi, and other agent harnesses. It guides agents toward concise, simple, and verified code by routing goals to suitable workflows and supporting subagent tools. The catalogue entries are the project's skills, agents, hook, and plugin implementations for these agent environments.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add michael-denyer/pstack-claude --skill thermo-nuclear-reviewgit clone --depth 1 https://github.com/michael-denyer/pstack-claudeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/michael-denyer/pstack-claude/thermo-nuclear-review)<a href="https://agentmods.dev/skills/michael-denyer/pstack-claude/thermo-nuclear-review"><img src="https://agentmods.dev/badge/skills/michael-denyer/pstack-claude/thermo-nuclear-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/michael-denyer/pstack-claude/thermo-nuclear-review"><img src="https://agentmods.dev/badge/skills/michael-denyer/pstack-claude/thermo-nuclear-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00059 | $0.00893 |
| Opus 5.5 | $0.00024 | $0.00357 |
| Sonnet 5.5 | $0.00012 | $0.00179 |
| Haiku 4.5 | $0.00006 | $0.00089 |
Grade A, and why
thermo-nuclear-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
3 near-identical copies found in the catalogue:
- thermo-nuclear-review — 97% identical, 5 lines differ
- thermo-nuclear-review — 95% identical, 5 lines differ
- thermo-nuclear-review — 94% identical, 6 lines differ
How it starts
The opening of the file, as written. The whole thing — 51 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Thermo Nuclear Review
Use this skill for a comprehensive security and correctness audit of a checked-out branch.
Prompt
You are a security expert performing a comprehensive review of a checked out branch. Audit this branch and its changes extremely thoroughly for bugs, changes that break existing features/functionality, and security vulnerabilities. Be EXTREMELY thorough, rigorous, careful, ambitious, and attentive. NOTHING can slip through.
Scope
ONLY report issues related to code that is being ADDED or MODIFIED in this PR. Focus on changes in the diff. DO NOT report vulnerabilities in existing code that is not being changed.
Guidelines
Breaking Functionality Guidelines
This is a complex codebase, with many cross-package/module dependencies. Often simple code changes in one place have subtle interactions that break functionality elsewhere. You MUST be extremely thorough in tracing through possible side effects of the changes.
Breaking Devex Guidelines
It can be easy to break developers' ability to run / build the code locally. You MUST catch changes that will impact users' developer experience. Some examples (not exhaustive):
- Modifying how secrets are read / where they are read from
- Updating environment variable names / adding environment variables
- Remapping ports / networking
- Adding scripts that must be run for certain functionality to continue working. Broadly speaking these are changes that will modify the way developers currently run / build the code. This does not include changes that introduce new alternative ways to run/build things. Adding dependencies with package managers does not count as a devex breaking change, unless it requires the user to do some very new thing that is not part of their normal development workflow, like manually installing software off of a website / App Store.
Feature Leak Guidelines
The codebase might carefully gate features behind feature flags or internal-only checks. You MUST NOT allow any features that are meant to be behind a feature gate leak. These leaks are often subtle. Be VERY careful and thorough.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 51 lines · 59 tokens per session scan A 8e285b67eb74
thermo-nuclear-review is a skill published in the GitHub repository michael-denyer/pstack-claude (2,366 stars, last pushed today), licensed MIT. It adds 59 tokens to every session and 893 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-13.
Other skills, from other repositories
code-review-excellence
Master effective code review practices to provide constructive feedback, catch bugs early, and foster knowledge sharing while maintaining team morale. Use when reviewing pull requests, establishing review standards, or mentoring developers.
multi-reviewer-patterns
Coordinate parallel code reviews across multiple quality dimensions with finding deduplication, severity calibration, and consolidated reporting. Use this skill when organizing multi-reviewer code reviews, calibrating finding severity, or consolidating review results.
ln-33-plan-reviewer
Reviews a concrete implementation plan for missing decisions, feasibility and risk before execution; read-only.
ln-52-delivery-reviewer
Reviews a completed change for acceptance, regressions and release risk; read-only, not a whole-codebase audit.
ln-41-surgical-change-implementer
Implements one scoped product feature or fix using existing contracts; not upgrades, performance tuning or establishing cross-cutting technical foundations.
ln-42-dependency-upgrader
Upgrades dependencies in reversible batches with version-specific compatibility and regression checks.