Audit candidate: alirezarezvani/claude-code-skill-factory

[xiaolai]

Repo

https://github.com/alirezarezvani/claude-code-skill-factory

Field	Value
Stars	721
NL Artifacts	27
Discovery strategy	topic-tag
Topics: claude-skills

Next Steps

1. Review the repo — check CONTRIBUTING.md, recent activity, PR history
2. If worthy: add label audit-ready to trigger the audit workflow
3. If not: close this issue

Checklist

• Accepts contributions
• Updated in last 60 days
• Not a fork or mirror
• Has meaningful NL artifacts

[github-actions]

Audit Complete: alirezarezvani/claude-code-skill-factory

NL Score: 80/100 | Security: REVIEW | Artifacts: 46 | Strategy: batched

NLPM Audit: alirezarezvani/claude-code-skill-factory

Date: 2026-04-29 | Artifacts: 46 | Strategy: full
NL Score: 80/100
Security: REVIEW
Bugs: 10 | Quality Issues: 4 | Security Findings: 3

NL Score Summary

File	Type	Score	Top Issue
.claude/agents/hooks-guide.md	agent	83	Hardcoded developer absolute path /Users/rezarezvani/… in Steps 5–6 bash blocks; 5 vague quantifiers (comprehensive×3, seamless, well-structured)
.claude/agents/skills-guide.md	agent	89	4 vague quantifiers (comprehensive×3, seamless)
.claude/agents/factory-guide.md	agent	87	Single conversation example; no failure or edge-case scenario; 3 vague quantifiers
.claude/agents/prompts-guide.md	agent	88	3 vague quantifiers (comprehensive, effective, optimal)
.claude/agents/agents-guide.md	agent	88	4 vague quantifiers (comprehensive×2, thorough, effective)
.claude/agents/README.md	doc	75	Navigation documentation only; not a registerable agent
.claude/commands/ci-guard.md	command	89	No allowed-tools field; 2 vague quantifiers
.claude/commands/sync-branch.md	command	89	No allowed-tools field; 2 vague quantifiers
.claude/commands/run-release.md	command	88	No allowed-tools field; 3 vague quantifiers (comprehensive, clean, smooth)
.claude/commands/sync-todos-to-github.md	command	82	No allowed-tools; uses positional $1/$2 instead of $ARGUMENTS; 3 vague quantifiers
.claude/commands/review.md	command	91	No allowed-tools field; 2 vague quantifiers
.claude/commands/security-scan.md	command	90	No allowed-tools field; 2 vague quantifiers
.claude/commands/git/rv.md	command	90	No allowed-tools field; 1 vague quantifier
.claude/commands/git/cp.md	command	90	No allowed-tools field; 1 vague quantifier
.claude/commands/git/sc.md	command	90	No allowed-tools field; 1 vague quantifier
.claude/commands/git/cm.md	command	90	No allowed-tools field; 1 vague quantifier
.claude/commands/git/pr.md	command	89	No allowed-tools field; 2 vague quantifiers
.claude/commands/test-factory.md	command	67	No YAML frontmatter; description absent; command will not register with Claude Code
.claude/commands/codex-exec.md	command	65	No YAML frontmatter; description absent; well-documented content wasted
.claude/commands/factory-status.md	command	66	No YAML frontmatter; description absent
.claude/commands/validate-output.md	command	67	No YAML frontmatter; description absent
.claude/commands/install-hook.md	command	65	No YAML frontmatter; description absent
.claude/commands/build.md	command	67	No YAML frontmatter; description absent
.claude/commands/build-hook.md	command	64	No YAML frontmatter; description absent
.claude/commands/sync-agents-md.md	command	65	No YAML frontmatter; description absent
.claude/commands/install-skill.md	command	66	No YAML frontmatter; description absent
.claude/commands/README.md	doc	76	Navigation documentation; not a registerable command
generated-skills/tdd-guide/SKILL.md	skill	84	7 vague quantifiers (comprehensive×4, intelligent×2, complex); multi-language support well-documented
generated-skills/ms365-tenant-manager/SKILL.md	skill	85	5 vague quantifiers; PowerShell generation use cases clear
generated-skills/claude-md-enhancer/SKILL.md	skill	87	5 vague quantifiers; 7-step interactive workflow precisely described
generated-skills/hook-factory/SKILL.md	skill	87	5 vague quantifiers; 10 templates with event types clearly enumerated
generated-skills/social-media-analyzer/SKILL.md	skill	80	4 vague quantifiers (comprehensive, actionable, accurate, reliable); output format section does not show example output shape
generated-skills/app-store-optimization/SKILL.md	skill	88	4 vague quantifiers; JSON input examples are concrete and exemplary
generated-skills/scrum-master-agent/SKILL.md	skill	84	6 vague quantifiers; outbound notification integration documented but opt-in mechanics unclear
generated-skills/slash-command-factory/SKILL.md	skill	86	5 vague quantifiers; three official Claude Code patterns accurately documented
generated-skills/tech-stack-evaluator/SKILL.md	skill	83	8 vague quantifiers (comprehensive×6, intelligent, data-driven); high-density vague language despite rich content
generated-skills/aws-solution-architect/SKILL.md	skill	84	6 vague quantifiers; architecture patterns and use cases clear
generated-skills/agent-factory/SKILL.md	skill	83	5 vague quantifiers; generation patterns described but output validation criteria vague
generated-skills/codex-cli-bridge/SKILL.md	skill	84	4 vague quantifiers; Codex CLI bridge use cases concrete
generated-skills/prompt-factory/SKILL.md	skill	88	4 vague quantifiers; 69 presets with domain taxonomy highly specific
generated-skills/content-trend-researcher/SKILL.md	skill	84	5 vague quantifiers; multi-platform coverage clearly enumerated

---

Full report: https://github.com/xiaolai/nlpm-for-claude/blob/main/auditor/audits/alirezarezvani-claude-code-skill-factory.md

12 bug(s) found. To submit fix PRs to the target repo, add the contribute-approved label to this issue.

[xiaolai]

PRs created for alirezarezvani/claude-code-skill-factory

Three pull requests submitted. All findings independently reproduced before submission.

PR	Title	Findings
#1049	fix(commands): add missing YAML frontmatter to 9 unregistered slash commands	BUG-missing-frontmatter ×9
#1050	fix(agents): remove hardcoded developer path from hooks-guide bash steps	BUG-hardcoded-path + SEC-hardcoded-developer-path
#1051	docs(scrum-master-agent): add Network Access disclosure to SKILL.md	outbound-webhook-calls (no JSONL fingerprint)

Note: PR #1051 metadata block contains an incorrect fingerprint (gh pr edit requires read:org scope which FORK_TOKEN lacks). The notify_channels.py finding has no fingerprint in findings-with-fp.jsonl; the correct metadata block should be {"version":1,"findings":[]}.

[xiaolai]

PRs opened for alirezarezvani/claude-code-skill-factory:

• #1052 fix(commands): add missing YAML frontmatter to 9 unregistered slash commands alirezarezvani/claude-code-skill-factory#1052 — fix(commands): add missing YAML frontmatter to 9 unregistered slash commands (bugs 1–9: test-factory, codex-exec, factory-status, validate-output, install-hook, build, build-hook, sync-agents-md, install-skill)
• #1053 fix(agents): replace hardcoded developer path in hooks-guide alirezarezvani/claude-code-skill-factory#1053 — fix(agents): replace hardcoded developer path in hooks-guide (bug 10 + security fix 2: lines 253 and 259 of hooks-guide.md)