NLPM Automated Audit: 2 bugs + 3 security fixes (score 85/100)

[xiaolai]

Automated audit: This issue was created by NLPM, a natural language programming linter, running via claude-code-action. All findings are provided in good faith — please evaluate them on their merits.

About This Audit

NLPM (Natural Language Programming Manager) scored this plugin's NL artifacts (skills, manifests, CLAUDE.md) on a 100-point scale and ran a security scan across executable surfaces (scripts, CLI source, package manifests).

Overall NL Score: 85/100 — well above the default 70-point threshold. This is a high-quality plugin with good structure and content depth.

Security: CLEAR — no Critical or High findings. Three Medium and two Low findings were found, three of which have straightforward code-level fixes.

---

Bugs Found (2)

Bug 1 — Priority: High

File: .claude/skills/slides/SKILL.md line 14
Issue: Raw template variable <args>$ARGUMENTS</args> left unsubstituted in the rendered skill body — a copy-paste artifact from a template generator. Renders as literal XML-like text visible to LLM consumers.
PR: #287

Bug 2 — Priority: Medium

File: .claude-plugin/plugin.json
Issue: Marketplace description claims "67 styles, 15 stacks" but the actual styles.csv has 84 entries and the description's own enumeration lists exactly 12 stacks (not 15). This sets incorrect expectations for users browsing the Claude marketplace.
PR: #282

---

Security Fixes Submitted (3 Medium)

Security Fix 1 — Medium

File: .claude/skills/brand/scripts/sync-brand-to-tokens.cjs line 253
Issue: execSync with a backtick template string. All variables are currently hardcoded constants, but the pattern is fragile — any future variable substitution with user input would create shell injection with no warning.
Fix: Replace with execFileSync('node', [...args]) to eliminate the shell-expansion surface.
PR: #283

Security Fix 2 — Medium

File: .claude/skills/ui-styling/scripts/shadcn_add.py line 101
Issue: npx shadcn@latest add silently downloads whatever npm publishes as latest on each run. No version pinning means each invocation may install a different (unverified) package.
Fix: Add a helper that reads the pinned version from the project's package.json, falling back to a documented default.
PR: #284

Security Fix 3 — Medium

File: cli/src/utils/github.ts line 72
Issue: downloadRelease() fetches a ZIP from GitHub releases and writes it to disk with no integrity check. A compromised release asset would be silently installed into user projects.
Fix: Add opt-in SHA-256 verification via a companion .sha256 asset; backward-compatible (no behavior change until a checksum file is uploaded to releases).
PR: #288

---

Informational (Not Submitted as PRs)

These are quality observations, not bugs. Sharing for awareness:

• ui-ux-pro-max/SKILL.md uses name: ui-ux-pro-max without the ckm: namespace prefix used by all other skills in this plugin
• ui-ux-pro-max/SKILL.md Step 1 contains "React Native (this project's only tech stack)" — a project-scoped note accidentally left in a published generic skill
• banner-design/SKILL.md and design/SKILL.md reference external skills (ai-artist, ai-multimodal, chrome-devtools, etc.) that are not bundled in this plugin

---

Thank you for maintaining this plugin — the design intelligence database is genuinely well-built and the skill content quality is strong. These findings are all minor rough edges on an otherwise excellent project.

[mrgoonie]

Summary: I checked the audit against current main; the findings are actionable, but most already have dedicated PRs and should be reviewed/merged individually rather than solved from this umbrella issue.

Decision: accepted / track via linked PRs

Evidence:

• Bug 1 is still present: .claude/skills/slides/SKILL.md contains literal <args>$ARGUMENTS</args>; PR fix: remove unsubstituted template variable from slides/SKILL.md #287 targets it.
• Bug 2 is still present in .claude-plugin/plugin.json: the description still says 67 styles and 15 stacks while the audit reports different generated-data counts; PR fix: correct style and stack counts in plugin.json description #282 targets it.
• Security fix PRs are open for the listed implementation concerns: fix: replace execSync template string with execFileSync in sync-brand-to-tokens.cjs #283 (execSync template string), fix: pin shadcn version instead of @latest in shadcn_add.py #284 (shadcn@latest), and fix: add SHA-256 checksum verification to GitHub release downloads #288 (release ZIP checksum verification).
• Related issue NLPM Audit: Bugs and security improvements found in automated NL quality scan #286 appears to be the same NLPM audit family, so maintainers should avoid duplicating review work across both umbrella issues.

Next step: review the linked focused PRs independently, with priority on #287/#282 for low-risk metadata/content correctness and #283/#284/#288 for security-hardening. Keep this issue open as the umbrella tracker until those PRs are accepted or explicitly rejected.