NLPM Audit: 1 bug fix + 4 security improvements (NL Score: 88/100)
Automated audit: This issue was generated by NLPM, a natural language programming linter, running via claude-code-action. Please evaluate everything on its merits.
About This Audit
geo-seo-claude was audited by NLPM (Natural-Language Programming Manager), a 100-point quality scorer for Claude Code plugins, skills, and agents. This is a fully automated, good-faith review — no human reviewed the code beyond reading tool output. All PRs linked below contain only minimal, targeted fixes.
Overall NL Score: 88/100 — this is a well-structured plugin with consistent skill and agent definitions. The issues below are mostly minor.
Bug Found (1)
| Priority | File | Issue |
|---|---|---|
| High | skills/geo-report/SKILL.md:23 |
Skill reference geo-llms-txt is hyphenated incorrectly; the actual installed skill is geo-llmstxt. When running the report workflow, llms.txt data is silently omitted from the generated client report. |
PR: https://github.com/zubair-trabzada/geo-seo-claude/pull/50
Security Improvements (4, Medium/Low only)
| Severity | File | Issue |
|---|---|---|
| Medium | scripts/webapp/app.py:214 |
app.run(debug=True) hardcoded — Werkzeug interactive debugger enabled unconditionally, allowing arbitrary code execution if the port is exposed |
| Medium | scripts/fetch_page.py:61 |
requests.get(url) called with no URL scheme validation — non-HTTP schemes like file:// could enable SSRF if passed via automation |
| Medium | scripts/llmstxt_generator.py:247 |
Crawled sub-URLs fetched without domain check — a malicious site's redirect links could steer the crawler to internal network addresses (SSRF) |
| Low | requirements.txt:10 + scripts/generate_pdf_report.py:919 |
rich spans major version boundary (permits 14.x); stdin read without a size cap |
PRs:
- https://github.com/zubair-trabzada/geo-seo-claude/pull/51 — Flask debug mode
- https://github.com/zubair-trabzada/geo-seo-claude/pull/52 — URL scheme validation
- https://github.com/zubair-trabzada/geo-seo-claude/pull/53 — Domain validation in llmstxt_generator
- https://github.com/zubair-trabzada/geo-seo-claude/pull/54 — Dependency pin + stdin guard
Not Submitted as PRs
Quality issues (missing model in agent frontmatter, vague quantifiers in skills) were noted but are intentionally excluded — NLPM only submits PRs for verifiable bugs and low/medium security fixes, never for style preferences.
NLPM Methodology
NLPM scores NL artifacts (agents, skills, slash commands) on a 100-point scale. Scores start at 100 and deterministic penalties are applied for:
- Missing required frontmatter fields
- Broken cross-component references
- Security patterns in executable surfaces (hooks, scripts, MCP configs)
- Vague language density in skill instructions
The full scoring rules are in the NLPM repo. This audit found no Critical or High security issues — those would require private disclosure rather than PRs.
Thank you for building and sharing geo-seo-claude. It's a well-organized plugin and these are genuinely minor issues.
Source: zubair-trabzada/geo-seo-claude