NLPM audit findings: 8 frontmatter bugs + 2 low-severity security improvements

[xiaolai]

Automated audit: This issue was generated by NLPM, a natural language programming linter, running via claude-code-action. Please evaluate the findings on their merits.

Hi @ChrisWiles 👋 — first, thank you for this showcase repo. It's a great reference for Claude Code's NL artifact system and the skill-rules hook design is particularly well thought out.

What is NLPM?

NLPM is a 100-point natural language programming linter that scores Claude Code artifacts (commands, agents, skills, hooks) against a rule set. It checks for structural correctness (frontmatter completeness, broken references) and quality patterns.

Your repo scored 81/100 — a solid result. The skill files and code-reviewer agent are especially clean (95/100 each).

Bugs Found (8 total)

All 8 bugs are missing frontmatter fields, which prevent command registration:

#	File	Issue	Impact
1	.claude/commands/code-quality.md	Missing name frontmatter	/code-quality cannot be registered
2	.claude/commands/docs-sync.md	Missing name frontmatter	/docs-sync cannot be registered
3	.claude/commands/onboard.md	Missing name frontmatter	/onboard cannot be registered
4	.claude/commands/onboard.md	Missing description frontmatter	No UI/discovery description
5	.claude/commands/onboard.md	Missing allowed-tools frontmatter	No declared tool boundary
6	.claude/commands/pr-review.md	Missing name frontmatter	/pr-review cannot be registered
7	.claude/commands/pr-summary.md	Missing name frontmatter	/pr-summary cannot be registered
8	.claude/commands/ticket.md	Missing name frontmatter	/ticket cannot be registered

Security Findings (Medium/Low)

Severity	File	Issue
Medium	.mcp.json	All 7 MCP servers use npx -y @anthropic/mcp-* with no version pin — a compromised npm publish is silently adopted
Medium	.mcp.json	@anthropic/mcp-postgres grants full DB read/write with no permission scoping
Low	.claude/commands/pr-review.md	Unquoted $ARGUMENTS in gh pr view $ARGUMENTS
Low	.claude/commands/code-quality.md	Unquoted $ARGUMENTS in npm run lint -- $ARGUMENTS

(No Critical or High findings — those would be disclosed privately.)

PRs Submitted

PR	Fixes
#17 — fix: add missing name frontmatter to 5 slash commands	Bugs 1, 2, 6, 7, 8
#18 — fix: add complete frontmatter to onboard.md	Bugs 3, 4, 5
#19 — fix: quote $ARGUMENTS in shell invocations	Security Low #3, #4

Each PR is a minimal, targeted fix. Please merge or close them as you see fit — no obligation either way.

Informational (not PRed)

• skill-rules.json references 13 skills with no corresponding SKILL.md files (navigation-architecture, state-management, github-actions, etc.). The hook will surface these names but Claude won't find the files. You may want to either create stub skills or remove the orphaned entries.
• The GitHub Actions workflows pin claude-opus-4-5-20251101 while .claude/agents/code-reviewer.md uses model: opus. These could drift; consider consolidating to a single source of truth.

Thanks again for publishing this repo — it's a useful reference for the community.