NLPM Audit Report: 6 bugs and 2 security disclosures found across 100 skills (score: 83/100)

[xiaolai]

Automated audit: This issue was generated by NLPM, a natural language programming linter, running via claude-code-action. Please evaluate the findings on their merits.

Overview

An automated NLPM audit of this repository examined 100 SKILL.md files. The collection scores 83/100 on the NLPM quality scale — a strong result showing well-structured, comprehensive skill documentation. This issue documents the actionable bugs found along with links to the PRs that address them.

NLPM Methodology

NLPM is a 100-point quality scoring system for Claude Code NL artifacts (skills, commands, agents). It applies deterministic penalties starting from a 100-point baseline. For skills, applicable penalties include: missing/malformed frontmatter fields, invalid code in examples, and vague quantifiers. The security scan separately checks executable surfaces (scripts, hooks, MCP configs) for high-risk patterns.

Audit date: 2026-04-25
Artifacts scanned: 100 SKILL.md files
Security status: CLEAR (no Critical or High patterns)

---

Bugs Found (Code-Correctness Issues)

These bugs will cause immediate failures for users who copy the affected commands.

BUG-1: Doubled uv prefix in install commands — 5 skills

The pattern uv uv pip install <pkg> appears in five skills. This is an invalid shell invocation — users copying these commands will get an immediate error.

Affected skills: scikit-learn, pyopenms, fluidsim (×3 occurrences), gtars, geniml (×3 occurrences)

Fix: Replace uv uv pip install with uv pip install

PR: #145

---

BUG-2: Wrong uv invocation in latchbio-integration — 1 skill

python3 -m uv pip install latch calls uv as a Python module rather than as a standalone binary. This is non-standard and may fail depending on how uv is installed.

Affected skill: latchbio-integration

Fix: Replace with uv pip install latch

PR: #146

---

BUG-3: License typo in scanpy frontmatter — 1 skill

license: SD-3-Clause license — the leading B is missing from BSD-3-Clause, making it an unrecognized SPDX identifier. Also has a redundant trailing license word.

Affected skill: scanpy

Fix: Change to license: BSD-3-Clause

PR: #147

---

Security Disclosures (Medium — Recommended Improvements)

No Critical or High security issues were found. The two Medium findings are disclosure gaps: users aren't informed that their content is transmitted to commercial APIs before they run the skill.

SEC-1: Undisclosed data transmission in scientific-schematics

generate_schematic_ai.py transmits user diagram prompts to openrouter.ai. The OPENROUTER_API_KEY requirement is documented in the skill body, but the frontmatter description — what users see at skill selection — didn't mention this.

PR: #148

---

SEC-2: Undisclosed data transmission in research-lookup

research_lookup.py sends user research queries to api.parallel.ai and, for academic searches, to openrouter.ai. The compatibility field mentions the API keys but not the data-transmission implication.

PR: #149

---

Summary

Priority	Finding	PR
High	BUG-1: uv uv pip install in 5 skills	#145
High	BUG-2: python3 -m uv pip install in latchbio-integration	#146
Medium	BUG-3: SD-3-Clause license typo in scanpy	#147
Medium	SEC-1: Data transmission disclosure in scientific-schematics	#148
Medium	SEC-2: Data transmission disclosure in research-lookup	#149

The overall collection quality is excellent. The bugs above are localized to installation commands and a single frontmatter typo — all straightforward to fix. Thank you for maintaining this high-quality scientific skills collection.