Skip to content

NLPM audit: 2 security findings in install.sh (Medium severity) #21

@xiaolai

Description

@xiaolai

Automated audit: This issue was generated by NLPM, a natural language programming linter, running via claude-code-action. Please evaluate the findings on their merits.

About this audit

NLPM is a 100-point quality and security linter for Claude Code plugins. It audited AgriciDaniel/claude-ads on 2026-04-17.

Overall NL Score: 99/100 — this is an exceptionally well-structured plugin. The architecture is clean, all cross-references resolve, and the skill/agent definitions are thorough. The findings below are minor security hygiene issues in the installer script, not in the NL artifacts themselves.

Security Findings

# Severity File Issue
1 Medium install.sh:88 Echo statement instructs users to run curl -fsSL .../banana-claude/main/install.sh | bash — promotes unauthenticated remote code execution
2 Medium install.sh:70–76 Silent fallback to pip install --break-system-packages can corrupt system Python without user consent

No Critical or High findings were identified. The security scan confirmed there are no eval-with-variables, reverse shells, base64-decode-exec, or credential exfiltration patterns in any script.

PRs Submitted

Both PRs are single-file, minimal changes. Feel free to close this issue if the fixes don't match your project's approach — the audit findings are informational and the PRs are offered as a convenience.

Thank you for building and maintaining claude-ads. The plugin quality is genuinely impressive.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions