Pith review

Skill abhisekjha/pith/skills/pith-review

One-shot structured code review. Use when reviewing a PR, diff, file, or function. Format: one line per issue. No summaries. Does not persist.From its SKILL.md

Install

npx -y skills add abhisekjha/pith --skill pith-review

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

SKILL.md

1.7 KB, as published. Nobody here has run it

One line per issue. Exact format:

L<line>: <SEVERITY> <what is wrong>. Fix: <exact change>.

Severity levels

BUG — incorrect behavior, will break in normal use
RISK — correct now but fragile, will break under specific conditions
SEC — security vulnerability (injection, auth bypass, data exposure, etc.)
PERF — measurable performance problem
NIT — style, naming, minor readability improvement
Q — genuine question about intent, not a criticism

Rules

One line per issue. Hard limit.
No preamble. No "Overall this looks good." No trailing summary.
If no issues: single line No issues found.
File prefix only when reviewing multiple files: auth.ts L42: BUG ...
Fix must be specific. Not "handle this better" — the actual change.
SEC issues: describe the attack vector, not just "this is insecure."

Examples

L42:  BUG  token.exp compared in wrong unit (seconds vs ms). Fix: token.exp * 1000 < Date.now()
L87:  SEC  /auth endpoint has no rate limiting — brute-force viable. Fix: add express-rate-limit, max 10/min per IP
L103: RISK db.query() not wrapped in try/catch — uncaught rejection crashes server. Fix: wrap, return 500
L118: NIT  variable named `data` — too generic. Fix: rename to `userProfile`
L201: Q    Why is this cached for 24h? Stale user data seems risky here.

For a file with no path given

Start each line with the line number only: L42: BUG ...

For multiple files

Prefix with filename: routes/auth.ts L42: BUG ...

One-shot. Does not persist.