菜单
Use when validating that all changes in the current branch are ready to be included in a release PR managed by release-please automation.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Hostile audit toolkit: one entry point dispatching specialist commands — adversarial review, security, tests, docs, architecture, performance, dependencies, error handling, CI, commits, migrations, observability, API contracts, a11y, privacy, config, resource leaks, i18n, concurrency, unwired code, PR review and review-comment implementation. Use when auditing or reviewing a repository, PR, or any quality dimension of a codebase — "audit this", "review the whole codebase", "find all problems", "exhaustive review", "/nitpicker <command>", a release gate check, or any specific audit ask (security scan, find race conditions, audit the tests, review the PR, fix the CR comments).
Use for any question about a codebase, its architecture, file relationships, or project content — especially when graphify-out/ exists, where the question should be treated as a graphify query first. Turns any input (code, docs, papers, images, videos) into a persistent knowledge graph with god nodes, community detection, and query/path/explain tools.
Routes audit requests to the right /nitpicker command. Use when the user wants to run one of the hostile audit commands in this repo, or asks what audit commands are available.
Use when verifying all skills in the repository are well-formed before a release or after adding/editing a skill.
Use when creating a new hostile audit command for the nitpicker skill in this repository.
Use when verifying that a skill actually changes Claude's behaviour — runs TDD pressure scenarios against a skill before and after writing it.
| name | release-prep |
| description | Use when validating that all changes in the current branch are ready to be included in a release PR managed by release-please automation. |
| disable-model-invocation | true |
Validates that the repository is in a clean, releasable state. Does not
create tags, bump versions, or push commits — release-please automation
manages all of that from main. The only action beyond validation is
offering to open a PR, and only after every gate passes and the user
explicitly approves.
Run the steps in order. Stop immediately and report findings to the user if any step fails. Do not proceed to the next step.
Run /validate-skills. It validates the public skill (router + command
files) and internal skills, plus the version-sync check
(scripts/check-version-sync.py). Any error: stop and report. Warnings
touching files changed in this branch must be fixed.
Run each gate command in this order. A gate passes when no Critical or High
finding remains open in the findings store after fixes are applied
(python3 skills/nitpicker/scripts/findings.py list --status open).
Any gate with an open Critical/High finding: stop and report.
| Gate | Command |
|---|---|
| Security | /nitpicker security |
| Documentation accuracy | /nitpicker docs (Critical and High must be resolved; Medium and below may be deferred as open findings) |
| Architecture | /nitpicker arch (refreshes the profile via /nitpicker arch-profile when missing or stale — staleness per that command's git-metadata rule) |
| Exhaustive review | /nitpicker audit |
| Enforcement loopholes | /nitpicker agent-loopholes |
| Hook coverage | /nitpicker agent-hooks |
| Performance | /nitpicker perf |
| Test-suite strength | /nitpicker tests |
| Dependency health | /nitpicker deps |
| Error handling | /nitpicker errors |
| Migration safety | /nitpicker migrations |
| Observability | /nitpicker observability |
| API contract | /nitpicker contract |
| Accessibility | /nitpicker a11y |
| CI/CD pipeline | /nitpicker ci |
| Commit discipline | /nitpicker commits |
| Concurrency safety | /nitpicker concurrency |
| Internationalization | /nitpicker i18n |
| Resource lifecycle | /nitpicker leaks |
| Configuration | /nitpicker config |
| Data privacy | /nitpicker privacy |
| Unwired implementations | /nitpicker unwired |
No-surface verdicts ("no auditable UI surface", "no localization surface", "no personal-data surface") pass their gate.
Run /nitpicker release-gate. It fails on any open finding at High or above
across all auditors — this is the aggregate backstop after the per-gate
fixes. If it fails: stop and report.
Confirm every commit on this branch follows the conventional commits format release-please uses for version bumps and release notes:
feat: — minor bump; fix: — patch bumpfeat!: or BREAKING CHANGE: footer — major bumpchore:, docs:, refactor: — no bumpgit log main..HEAD --oneline
Any non-conforming message: stop; instruct the user to reword via
git rebase -i main. Do not require a manual CHANGELOG.md entry —
release-please manages the changelog.
Check .github/workflows/validate-skills.yml passed on the current commit.
Failing CI: stop and report which checks failed.
After all steps pass, present:
✅ All release gates passed.
[✓] validate-skills — no skill errors; all 5 version files in sync at vX.Y.Z
[✓] all audit gates — no open Critical/High findings (see INDEX.md)
[✓] /nitpicker release-gate — PASS (threshold High)
[✓] conventional commits — all commits on branch use valid format
[✓] CI — validate-skills.yml passing
Release-please automation will create the Release PR when these changes are
merged to main. No manual version bump or tagging is needed.
Then ask:
Create a PR for these changes? (y/n) [default: n]
n or no answer: stop; inform the user no PR was created. y: open a PR
using the branch's conventional commit messages for title and description.
Do not bump versions, create tags, or push beyond what is staged.