Audit candidate: Vincentwei1021/video-shotcraft

[xiaolai]

Repo

https://github.com/Vincentwei1021/video-shotcraft

Field	Value
Stars	3749
NL Artifacts	116

Next Steps

1. Review the repo — check CONTRIBUTING.md, recent activity, PR history
2. If worthy: add label audit-ready to trigger the audit workflow
3. If not: close this issue

Checklist

• Accepts contributions — 4 external PRs merged (echo719 x2, tura-ai-agent, sarff0); no CONTRIBUTING.md / CLA gate
• Updated in last 60 days — pushed 2026-08-07
• Not a fork or mirror
• Has meaningful NL artifacts

Why this was seeded by hand

auditor-discover could not have found this repo. The artifact probe scored it 1 (.claude-plugin/plugin.json alone), below the MIN_ARTIFACTS=5 floor, because no pattern anchored at a repo-root SKILL.md — the canonical single-skill layout in the open Agent Skills spec. The probe is fixed in the same PR as this seed (now scores 2), but 2 is still under the floor: the repo's real NL surface is a 104-card references/shots/ tree that no probe pattern reaches. See the PR for that open design question.

Pre-seed review (manual audit at 0022ec4)

Check	Result
bin/nlpm-check	clean — 0 high / 0 medium / 0 low
Security	PASS — no Critical or High patterns; no hooks, no MCP, no install scripts
NL Score	98 — SKILL.md 95, .claude-plugin/plugin.json 100, agents/openai.yaml 100
Contribution	1 finding, PR opened: Vincentwei1021/video-shotcraft#28

The audit workflow should re-derive all of this independently — the numbers above are from a hand pass over 3 artifacts and are not a substitute for the pipeline's own scorer, which will sample more of the corpus.

Expected to clear the exemplar gate (score >= 90, security != BLOCKED). Candidate rules to exemplify: R01 (zero vague quantifiers corpus-wide), R05 (205-line router over a 1,634-line reference layer), R07 (the 何时读哪个文件 dispatch table), R37 (104/104 reference pointers resolve; every numeric claim exact).

[github-actions]

Audit Complete: Vincentwei1021/video-shotcraft

NL Score: 100/100 | Security: REVIEW | Artifacts: 2 | Strategy: single

NLPM Audit: Vincentwei1021/video-shotcraft

Date: 2026-04-06 | Artifacts: 2 | Strategy: single
NL Score: 100/100
Security: REVIEW
Bugs: 0 | Quality Issues: 0 | Security Findings: 5

NL Score Summary

File	Type	Score	Top Issue
.claude-plugin/plugin.json	Plugin manifest	100	None — required fields present, skills path resolves
SKILL.md	Skill	100	None — frontmatter complete, all cross-references resolve, no vague quantifiers found

Security Scan

Severity	Count
Critical	0
High	0
Medium	2
Low	3

Execution Surface Inventory

Surface	Files
Hooks	none
Scripts	assets/scripts/capture-template.mjs, gallery/app.js, gallery/build-seo.py, gallery/fetch-media.sh, gallery/sync-from-cards.py
MCP configs	none
Package manifests	template/package.json

Security Findings

#	Severity	File	Line	Pattern	Description
1	Medium	gallery/app.js	152	unescaped-attribute-interpolation	style.media.url is interpolated directly into a data-src="..." attribute with no escapeHtml() call, unlike the sibling title/sourceUrl values in the same function that are escaped; a value containing " could break out of the attribute and inject markup/handlers.
2	Medium	gallery/app.js	158	unescaped-attribute-interpolation	Same unescaped style.media.url interpolation in the <video data-src="..."> branch of mediaMarkup().
3	Low	gallery/fetch-media.sh	7	network-call	gh release download fetches media assets from GitHub over the network; benign (hardcoded repo, no user-controlled input) but recorded per the execution-surface inventory.
4	Low	template/package.json	17	unpinned-semver	@types/react pinned with caret range ^19.2.17 while runtime deps (remotion, react) are pinned to exact versions.
5	Low	template/package.json	18	unpinned-semver	typescript pinned with caret range ^6.0.3, inconsistent with the exact-pinned runtime dependencies.

Bugs (PR-worthy)

No bugs found.

Security Fixes (PR-worthy, Medium/Low only)

#	File	Issue	Suggested Fix
1	gallery/app.js	style.media.url interpolated unescaped into data-src attribute (lines 152, 158)	Wrap with escapeHtml(style.media.url), matching the existing pattern used for sourceUrl and title in the same file.
2	template/package.json	@types/react and typescript devDependencies use caret ranges while runtime deps are exact-pinned	Pin @types/react and typescript to exact versions for build reproducibility, consistent with remotion/react/react-dom.

Quality Issues (informational)

No quality issues found.

Cross-Component

---

Full report: https://github.com/xiaolai/nlpm/blob/main/auditor/audits/Vincentwei1021-video-shotcraft.md

2 bug(s) found. To submit fix PRs to the target repo, add the contribute-approved label to this issue.

[xiaolai]

Opened 1 PR against Vincentwei1021/video-shotcraft:

• fix: escape media.url in gallery data-src attributes Vincentwei1021/video-shotcraft#30 — escape style.media.url in gallery data-src attributes (reproduced XSS-style attribute-breakout injection; fixed to match existing escapeHtml() pattern used elsewhere in the file)

The two unpinned-semver findings (@types/react, typescript caret ranges in template/package.json) were dropped after independent review — caret-pinned devDependencies while runtime deps are exact-pinned is a common, defensible choice and doesn't reproduce a concrete break, so no PR was opened for those.

[github-actions]

Exemplar published

Score 100/100 — added as a teaching artifact at auditor/exemplars/Vincentwei1021-video-shotcraft.md.

Rules from skills/nlpm/rules/ can now cite this repo as a positive real-world example.

View exemplar