Nitpicker — a hostile audit toolkit for coding agents. One skill, one entry point, a full deck of audit command: Assumes the code is incorrect until proven otherwise. Every command files findings with evidence and a concrete fix — no compliments, no hedging.
Command
Hostile audit of coding-agent configuration the project installed rather than wrote: skills, subagents, commands, plugins, hooks, and rule files obtained from a marketplace, a git URL, a gist, or a teammate. Assume every installed instruction file is attacker-authored until read, and that the attacker's goal is to be…
Command
Scans the whole codebase for implementations that exist but are never wired in — and for wired implementations left incomplete — then, per finding and only with explicit user confirmation, wires, transfers, or removes them.
Command
Migrates legacy 1.x single-document findings files (docs/audit/ -findings.md) into the per-finding store, preserving every piece of information the old format held. Internal command: it is not advertised in the public command listing, but dispatches like any other.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: