By ivuorinen
Hostile audit skills for Claude Code: adversarial code review, architecture detection and auditing, and documentation verification.
Performs hostile code review assuming bugs exist, hunting for logic errors, edge cases, security flaws, and missing tests. Use when asked to review code, find bugs, audit for correctness, stress-test a PR, or when someone says "tear this apart" or "what's wrong with this".
Audits a codebase for architectural violations against detected or declared patterns and writes a structured findings report. Use when auditing a codebase for architectural violations, dependency rule breaches, layer boundary violations, or pattern inconsistencies. Triggers: "audit the architecture", "find architecture violations", "check layer boundaries", "run arch-auditor", "are there any DDD violations?", "check hexagonal boundaries".
Detects which architectural patterns a codebase uses and produces docs/audit/arch-profile.md with inferred structural rules. Use when you need to identify which architectural patterns a codebase uses, understand its structural boundaries, or generate an architecture profile before auditing. Triggers: "what architecture is this?", "detect the architecture", "profile this codebase", "what pattern does this follow?", "run arch-detector".
Audits .claude/rules/ files for quality and suggests new rules from project conventions and audit artifacts. Use when auditing .claude/rules/ files for quality and completeness, checking CLAUDE.md for rules that belong in .claude/rules/ instead, or discovering new rules from project conventions and audit artifacts.
Fetches GitHub PR review comments, evaluates validity, and implements valid ones one at a time with test verification. Use when implementing unresolved GitHub PR review comments, when told "fix the cr comments", "implement review feedback", "address pr comments", or when a PR has unresolved reviewer comments that need addressing.
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Hostile audit skills for Claude Code.
Skills are listed in preferred execution order. [nitpicker][nitpicker] is the orchestrator — start there for a full audit.
| Skill | Description |
|---|---|
[nitpicker][nitpicker] | Exhaustive repository audit; finds defects across code, tests, docs, and config; optionally applies fixes |
[arch-detector][arch-detector] | Detects which architectural patterns a codebase uses (19 patterns, 8 canonical combinations) |
[arch-auditor][arch-auditor] | Audits codebase for architectural violations against detected or declared patterns |
[doc-auditor][doc-auditor] | Verifies all documentation accuracy against the codebase; finds stale, incorrect, and missing docs |
[security-auditor][security-auditor] | Audits a codebase with available security scanners, parses results, and writes a consolidated findings report |
[adversarial-reviewer][adversarial-reviewer] | Hostile code review; assumes bugs exist and hunts for them |
[pr-reviewer][pr-reviewer] | Hostile but constructive PR review; outputs copy-paste-ready markdown for GitHub PR comments |
[cr-implementer][cr-implementer] | Fetches GitHub PR review comments (unresolved where available via GraphQL), evaluates and implements valid ones one at a time, verifies with tests and linting, and asks user whether to leave/commit/push |
[claude-rules-auditor][claude-rules-auditor] | Audits .claude/rules/ files for quality, checks CLAUDE.md for misplaced rules, and suggests new rules from project conventions and audit artifacts |
[loophole-hunter][loophole-hunter] | Audits the Claude Code enforcement surface (.claude/rules/, hooks, .claude/settings.json, permissions, skills) for bypassable or unenforced constraints and closes them; invoked by nitpicker in loophole mode and by release-prep as a gate |
[hooks-enforcer][hooks-enforcer] | Audits an agent project's hook coverage against its evidence base (current hooks, audit-findings history, git history, project memory); finds recurring failures no hook guards and context-discipline gaps where large-output work bypasses a context-saving tool; specifies and wires the missing hooks in the host harness's correct shape; invoked by nitpicker in loophole mode and by release-prep as a gate |
/plugins marketplace add ivuorinen/skills
/plugins install ivuorinen-skills
Invoke any skill by name in Claude Code (listed in execution order):
/nitpicker — exhaustive audit + optional auto-fix/arch-detector — detect architecture patterns/arch-auditor — audit architecture violations/doc-auditor — verify documentation accuracy/security-auditor — security audit with available local scanners/adversarial-reviewer — hostile code review/pr-reviewer — PR review (stdout only)/cr-implementer — implement PR review comments/claude-rules-auditor — audit .claude/rules/ and CLAUDE.md rule placement/loophole-hunter — audit the Claude Code enforcement surface and close loopholes/hooks-enforcer — audit hook coverage against the project's evidence base and wire the missing hooks/nitpicker
Exhaustive audit of code, tests, docs, and config. Findings written to docs/audit/nitpicker-findings.md. At the end, nitpicker offers to apply fixes and asks before committing.
/nitpicker security # invokes security-auditor, then extends with trust-boundary analysis
/nitpicker docs # invokes doc-auditor, then extends with inline comment accuracy
/nitpicker architecture # invokes arch-detector + arch-auditor, then extends with coupling analysis
/nitpicker changed-files # limit review to modified files and their dependencies only
/nitpicker release-gate # fail if any High or Critical findings exist (CI gate)
/nitpicker inline # return findings in the response, no file written
/arch-detector # detect patterns → writes docs/audit/arch-profile.md
/arch-auditor # find violations → writes docs/audit/arch-findings.md
Run arch-detector first — arch-auditor reads the profile and produces stronger, more precise findings.
/security-auditor
Probes for available scanners (semgrep, grype, trivy, gitleaks, checkov, gosec, snyk, npm/yarn/pnpm audit) and runs all that are present.
/pr-reviewer # review the current branch diff
/pr-reviewer 42 # review PR #42 on GitHub
Output is copy-paste-ready markdown for GitHub PR comments.
npx claudepluginhub ivuorinen/skills --plugin ivuorinen-skillsMake your AI agent code with your project's architecture, rules, and decisions.
Access official Microsoft documentation, API references, and code samples for Azure, .NET, Windows, and more.
29 specialized Claude Code skills for building architecture. Core 18 skills cover design theory, building programming, concept design, building typology, spatial planning, envelope design, structural systems, MEP services, daylighting, materials, building codes, accessibility, fire safety, acoustics, building-scale sustainability, and construction documentation. Country-specific dossiers (v1.1.0) provide clause-level regulatory precision for 10 priority jurisdictions: India (NBC 2016, ECBC, IS codes, state DCRs), UAE (Dubai Building Code 2021, ADIBC, UAE FLS Code 2018, Estidama, Al Sa'fat), Saudi Arabia (SBC 201-1001, Mostadamah, NEOM/Royal Commission jurisdictions), USA (IBC 2024, IECC 2024, NFPA 101, ADA 2010, ASCE 7-22, state amendments incl. CA Title 24, NYC, FL HVHZ), UK (Building Regulations 2010 + Approved Documents A-S, Building Safety Act 2022, BSR/HRB, Scotland/Wales/NI), Germany (MBO + 16 LBOs, GEG 2023, DIN 18040/4109/4108, Eurocode NAs), Singapore (BCA Building Control Act, SCDF Fire Code 2018, Green Mark 2021, URA Master Plan), Japan (Building Standards Act, two-level seismic design, Sho-Energy Ho 2015, Heart Building Law, AIJ standards, BCJ evaluation), China (GB 50352-2019, GB 50016-2014, GB 50011-2010, JGJ residential energy codes, DB local supplements, sunlight rights), Australia (NCC 2022 Vol 1-3, AS/NZS 1170 series, AS 1428.1-2021, NatHERS 7-star, state planning systems). Geographic-foundations skill auto-detects jurisdiction and routes to the correct country dossier. References 50+ architects and theorists, IBC/Eurocodes/ASCE/ASHRAE/ADA/NFPA/ISO standards, sustainability frameworks (LEED, BREEAM, Passive House, DGNB, CASBEE, Green Mark, Green Star, NABERS, Mostadamah, Estidama, GRIHA, IGBC). Includes 7 Python calculators.
Upstash Context7 MCP server for up-to-date documentation lookup. Pull version-specific documentation and code examples directly from source repositories into your LLM context.
Comprehensive C4 architecture documentation workflow with bottom-up code analysis, component synthesis, container mapping, and context diagram generation
Build and maintain an LLM-curated personal knowledge base in your project — Andrej Karpathy's LLM Wiki pattern, designed to scale to thousands of pages without becoming a context bottleneck. Now with an optional compiled graph layer for typed, provenance-backed relationships.