Skip to content

NLPM audit findings: 13 bugs + 3 security improvements #49

Description

@xiaolai

Automated audit: This PR was generated by NLPM, a natural language programming linter, running via claude-code-action. Please evaluate the diff on its merits.

About this audit

This issue summarizes the results of an automated NL-quality scan of this repository by NLPM (Natural Language Programming Manager), a linter for Claude Code artifacts (agents, commands, skills, hooks).

NLPM scores repositories on a 100-point scale — this repo scored 77/100, which is respectable for a hooks-focused demo repo. The 5 PRs below address mechanical bugs only; quality suggestions are listed at the bottom for informational purposes.

No Critical or High security findings were found. The Medium/Low security items are minor and confined to the project's demo nature.


Bugs fixed by PRs

These are mechanical defects — missing fields that Claude Code requires to function correctly. The PRs make the smallest possible change to fix each one.

# Priority File Issue PR
1 High .claude/agents/llm-ai-agents-and-eng-research.md WebSearch used in step 2 instructions but not declared in tools — WebSearch calls fail silently at runtime #46
2 High .claude/commands/cook.md No frontmatter — command is undiscoverable in slash-command UI #47
3 High .claude/commands/cook_research_only.md No frontmatter — command is undiscoverable in slash-command UI #47
4 High .claude/commands/all_tools.md No frontmatter — command is undiscoverable in slash-command UI #48
5 High .claude/commands/update_status_line.md No frontmatter — command is undiscoverable in slash-command UI #48
6-12 High .claude/commands/agent_prompts/*.md (7 files) No frontmatter on any of the 7 agent prompt command files — undiscoverable #41
13 Medium .claude/commands/sentient.md Description "Manage, organize and ships your codebase" does not match demo content that runs rm -rf; risks misrouting in auto-dispatch #43

Remaining bugs (not covered by PRs — max 5 PRs per run)

The 5 PRs above cover the most impactful bugs. The remaining items from the audit are informational:

  • prime_tts.md: description appears to already be present in current HEAD — the audit may have been run against an older commit
  • Security (Medium): setup.py runtime package install runs on --install-deps flag — consider gating behind explicit user confirmation
  • Security (Low): apps/task-manager/package.json uses ^ semver ranges — consider pinning to exact versions or committing a lockfile

Quality observations (informational, no PRs)

These are improvements that would raise the score but are not bugs:

  • 13 thin crypto agents delegate entirely via Read and Execute to prompt files — the prompt files lack example invocations and output format specs (adds examples would improve score)
  • CLAUDE.md is effectively empty — given the depth of hooks and agents here, a project context section would help Claude bootstrap faster in new sessions
  • Several agent files (work-completion-summary.md, hello-world-agent.md, llm-ai-agents-and-eng-research.md) omit a model declaration

This is a high-quality, well-structured repo. The hooks architecture is genuinely impressive and the crypto agent tier design (haiku/sonnet/opus variants) is a clean pattern. Thank you for sharing it publicly!

Please feel free to close this issue and the PRs if the changes don't fit the project's style or intent — no obligation.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions