NLPM audit findings: 9 bugs across command frontmatter and security scripts

[xiaolai]

Automated audit: This issue was generated by NLPM, a natural language programming linter, running via claude-code-action. Please evaluate the findings on their merits.

About NLPM

NLPM is a natural-language programming linter for Claude Code plugins. It scores NL artifacts on a 100-point scale, checks for missing or malformed frontmatter, scans executable surfaces for security risks, and verifies cross-component consistency. This plugin scored 66/100 at audit time.

Summary

The audit found 9 bugs across two categories: missing command frontmatter fields (systemic across all 8 commands) and two low/medium security issues in the installer and share scripts. No critical or high severity security issues were found — the plugin received a CLEAR security gate decision.

Bugs Found

Priority 1: Missing name field in command frontmatter (affects all 8 commands)

Every command in the plugin has a description field in its YAML frontmatter but is missing the required name field. Without name, command registration may be incomplete in environments that rely on explicit name lookup rather than filename inference.

#	File	Status
1	commands/diff-review.md	Addressed in PR #43
2	commands/fact-check.md	Addressed in PR #43
3	commands/generate-slides.md	Addressed in PR #43
4	commands/generate-visual-plan.md	Addressed in PR #43
5	commands/generate-web-diagram.md	Addressed in PR #43
6	commands/plan-review.md	Addressed in PR #43
7	commands/project-recap.md	Addressed in PR #43

Priority 2: share.md has no YAML frontmatter at all

commands/share.md is formatted as README documentation (markdown headings, code fences, prose sections) rather than as a command template. It has neither name nor description in frontmatter, so it will not register correctly as a slash command and diverges from the convention used by every other command in the plugin.

#	File	Status
8	commands/share.md — missing name	Addressed in PR #47
9	commands/share.md — missing description	Addressed in PR #47

Security Fixes (Medium/Low only)

#	File	Severity	Issue	Status
S1	plugins/visual-explainer/scripts/share.sh	Medium	Deployed HTML is public with no pre-deploy warning	Addressed in PR #45
S2	install-pi.sh	Low	sed used | delimiter; breaks silently if $HOME contains |	Addressed in PR #45

Pull Requests

• PR fix: add missing name field to all command frontmatter blocks #43: fix: add missing name field to all command frontmatter blocks — adds name: to 7 command files
• PR fix: rewrite share.md as a proper command template with YAML frontmatter #47: fix: rewrite share.md as a proper command template with YAML frontmatter — rewrites share.md to follow plugin conventions
• PR fix: harden install-pi.sh and share.sh against supply-chain and data-exposure risks #45: fix: harden install-pi.sh and share.sh — fixes sed delimiter and adds public-deploy warning

Notes

This is an automated contribution. All PRs make minimal, targeted changes matching the existing code style. No quality/style issues were included — only verified bugs and safe security improvements. Please review each PR on its merits and feel free to close or modify as you see fit. The plugin is well-structured overall; these are small gaps in an otherwise solid implementation.