Borrowing it
Nothing to install: this file belongs to Thurbeen/thurbox. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Thurbeen/thurbox/main/.agents/skills/thurview/SKILL.mdgit clone --depth 1 https://github.com/Thurbeen/thurboxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/thurbeen/thurbox/thurview)<a href="https://agentmods.dev/skills/thurbeen/thurbox/thurview"><img src="https://agentmods.dev/badge/skills/thurbeen/thurbox/thurview.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
- medium MCP Rug Pull · line 28 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00102 | $0.02160 |
| Opus 5 | $0.00051 | $0.01080 |
| Sonnet 5 | $0.00020 | $0.00432 |
| Haiku 4.5 | $0.00010 | $0.00216 |
Grade A, and why
thurview scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 220 lines — stays where its author put it; the contents beside it link to each section on GitHub.
thurview
The agent studies the change and writes a short document in which every claim about code is anchored to an exact file and line range at a pinned commit. thurview validates those anchors, seals a revision, and serves it in the browser with live code peeks, diffs, diagrams and a map. The reader asks questions, leaves anchored comments, and approves or requests changes. The agent answers, updates, republishes.
flowchart LR
A[scaffold: pin base and head] --> B[author review.md, data.yaml, map.yaml]
B --> C[publish: validate and seal revision]
C --> D[open: reader reviews in the browser]
D -->|question| E[threads reply]
E --> D
D -->|request changes| B
D -->|approve| F[done]
Run the CLI as thurview. When it is not on PATH, npx -y thurview runs
the published package with the same commands; substitute it everywhere below.
Every command prints TOON on stdout: the result, then help[] with the next
commands. Errors are structured on stdout too (error, code, help); exit
code 1 is a failure, 2 a usage error such as an unknown flag. Progress goes to
stderr; do not scrape it. thurview alone shows the reviews of the current
directory; thurview <command> --help shows flags and examples.
Request
$ARGUMENTS
Empty: the current branch against its up-to-date trunk. A PR number or URL:
that pull request. --base/--head: that range. Anything else: an
architecture review of that topic in the current repository.
Before authoring
Read the guidance files that exist, in this order. The second wins on conflict.
~/.thurview/THURVIEW.md(or$THURVIEW_HOME/THURVIEW.md), user guidance.THURVIEW.mdat the repository root, repository guidance.
thurview scaffold lists the ones it found under guidance.
Read Document authoring before you write.
Read Components before you edit data.yaml or add
a fenced component. Read Lifecycle for statuses,
storage and thread rules. Read Software map
before you author map.yaml. Read Theme before you
write theme.yaml.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 220 lines · 102 tokens per session scan A 8431c1b3047c
thurview is a skill published in the GitHub repository Thurbeen/thurbox (60 stars, last pushed yesterday), licensed MIT. It adds 102 tokens to every session and 2,160 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-06.
Other skills, from other repositories
autoreview
Pre-commit/ship code review: Codex default; optional Claude or Pi.
rework-rate
Measure and interpret PR rework rate — the emerging 5th DORA metric.
omh-code-review
This is a Hermes-native code-review workflow skill.
revdiff-plan
Review the last Codex assistant message (plan, analysis, or proposal) with inline annotations in a TUI overlay. Extracts the most recent response from Codex rollout files and opens it in revdiff for review and annotation. Activates on "revdiff-plan", "review plan with revdiff", "annotate plan", "review last response"…
code-reviewer
Code review specialist focused on patterns, bugs, security, and performance.
agent-teams-simplify-and-harden
Implementation + audit loop using parallel agent teams with structured simplify, harden, and document passes. Spawns implementation agents to do the work, then audit agents to find complexity, security gaps, and spec deviations, then loops until code compiles cleanly, all tests pass, and auditors find zero issues or…