Automated audit: This issue was generated by NLPM, a natural language programming linter, running via claude-code-action. Please evaluate the findings on their merits.
About this audit
NLPM is a 100-point quality and security linter for Claude Code plugins. It audited AgriciDaniel/claude-ads on 2026-04-17.
Overall NL Score: 99/100 — this is an exceptionally well-structured plugin. The architecture is clean, all cross-references resolve, and the skill/agent definitions are thorough. The findings below are minor security hygiene issues in the installer script, not in the NL artifacts themselves.
Security Findings
| # |
Severity |
File |
Issue |
| 1 |
Medium |
install.sh:88 |
Echo statement instructs users to run curl -fsSL .../banana-claude/main/install.sh | bash — promotes unauthenticated remote code execution |
| 2 |
Medium |
install.sh:70–76 |
Silent fallback to pip install --break-system-packages can corrupt system Python without user consent |
No Critical or High findings were identified. The security scan confirmed there are no eval-with-variables, reverse shells, base64-decode-exec, or credential exfiltration patterns in any script.
PRs Submitted
Both PRs are single-file, minimal changes. Feel free to close this issue if the fixes don't match your project's approach — the audit findings are informational and the PRs are offered as a convenience.
Thank you for building and maintaining claude-ads. The plugin quality is genuinely impressive.
About this audit
NLPM is a 100-point quality and security linter for Claude Code plugins. It audited
AgriciDaniel/claude-adson 2026-04-17.Overall NL Score: 99/100 — this is an exceptionally well-structured plugin. The architecture is clean, all cross-references resolve, and the skill/agent definitions are thorough. The findings below are minor security hygiene issues in the installer script, not in the NL artifacts themselves.
Security Findings
install.sh:88curl -fsSL .../banana-claude/main/install.sh | bash— promotes unauthenticated remote code executioninstall.sh:70–76pip install --break-system-packagescan corrupt system Python without user consentNo Critical or High findings were identified. The security scan confirmed there are no eval-with-variables, reverse shells, base64-decode-exec, or credential exfiltration patterns in any script.
PRs Submitted
Both PRs are single-file, minimal changes. Feel free to close this issue if the fixes don't match your project's approach — the audit findings are informational and the PRs are offered as a convenience.
Thank you for building and maintaining claude-ads. The plugin quality is genuinely impressive.