Audit candidate: nicobailon/visual-explainer

[xiaolai]

Repo

https://github.com/nicobailon/visual-explainer

Field	Value
Stars	7692
NL Artifacts	10
Discovery strategy	awesome-list-citation
Cited by: awesome-claude-code, awesome-claude-plugins

Next Steps

1. Review the repo — check CONTRIBUTING.md, recent activity, PR history
2. If worthy: add label audit-ready to trigger the audit workflow
3. If not: close this issue

Checklist

• Accepts contributions
• Updated in last 60 days
• Not a fork or mirror
• Has meaningful NL artifacts

[github-actions]

Audit Complete: nicobailon/visual-explainer

NL Score: 66/100 | Security: CLEAR | Artifacts: 11 | Strategy: single

NLPM Audit: nicobailon/visual-explainer

Date: 2026-04-06 | Artifacts: 11 | Strategy: single
NL Score: 66/100
Security: CLEAR
Bugs: 9 | Quality Issues: 21 | Security Findings: 4

NL Score Summary

File	Type	Score	Top Issue
commands/share.md	command	35	No YAML frontmatter at all — both name and description missing
commands/generate-slides.md	command	44	Missing name (-25), no empty-input handling (-10), multi-step not numbered (-10)
commands/generate-visual-plan.md	command	54	Missing name (-25), no empty-input handling (-10)
commands/generate-web-diagram.md	command	54	Missing name (-25), no empty-input handling (-10)
commands/plan-review.md	command	56	Missing name (-25), no empty-input handling (-10)
commands/diff-review.md	command	62	Missing name (-25), vague quantifiers (-8)
commands/project-recap.md	command	64	Missing name (-25), vague quantifiers (-6)
commands/fact-check.md	command	68	Missing name (-25)
SKILL.md	skill	88	Scattered vague quantifiers — "key" used ~6 times without concrete threshold (-12)
.claude-plugin/plugin.json	plugin manifest	100	None
plugins/visual-explainer/.claude-plugin/plugin.json	plugin manifest	100	None

Weighted average: (35+44+54+54+56+62+64+68+88+100+100) / 11 = 66/100

Security Scan

Severity	Count
Critical	0
High	0
Medium	2
Low	2

Execution Surface Inventory

Surface	Files
Hooks	0
Scripts	install-pi.sh, plugins/visual-explainer/scripts/share.sh
MCP configs	0
Package manifests	package.json (no scripts section — clean)

Security Findings

#	Severity	File	Line	Pattern	Description
1	Medium	install-pi.sh	13	network-fetch-external-code	git clone --depth 1 https://github.com/nicobailon/visual-explainer.git "$TEMP_DIR" fetches and installs external code at runtime. URL is hardcoded (limits risk), but supply-chain compromise of the upstream repo would transparently deliver malicious content to installers.
2	Medium	plugins/visual-explainer/scripts/share.sh	54	network-deploy-public	bash "$VERCEL_SCRIPT" "$TEMP_DIR" deploys the user-supplied HTML file to a public Vercel URL. Any sensitive data embedded in the file becomes publicly accessible. VERCEL_SCRIPT is resolved from hardcoded paths, limiting injection risk.
3	Low	install-pi.sh	23	file-delete-fixed-path	rm -rf "$SKILL_DIR" removes $HOME/.pi/agent/skills/visual-explainer before reinstallation. Path is fully hardcoded; no user input involved. Risk is accidental wipe of skill data if the script is re-run unexpectedly.
4	Low	install-pi.sh	28–30	file-write-path-substitution	sed -i "s|{{skill_dir}}|$SKILL_DIR|g" interpolates $SKILL_DIR (derived from $HOME) into a sed command using | as delimiter. If $HOME contains |, the sed expression breaks. Unlikely in practice but worth noting.

Bugs (PR-worthy)

#	File	Issue	Impact

---

Full report: https://github.com/xiaolai/nlpm-for-claude/blob/main/auditor/audits/nicobailon-visual-explainer.md

12 bug(s) found. To submit fix PRs to the target repo, add the contribute-approved label to this issue.

[xiaolai]

Contribution run complete for nicobailon/visual-explainer.

PRs submitted

#	Title	URL
43	fix: add missing name field to all command frontmatter blocks	nicobailon/visual-explainer#43
44	fix: rewrite share.md as a command template with YAML frontmatter	nicobailon/visual-explainer#44
45	fix: harden install-pi.sh and share.sh against supply-chain and data-exposure risks	nicobailon/visual-explainer#45

Tracking issue

nicobailon/visual-explainer#46

Summary

• 9 NL bugs fixed across 2 PRs: missing name frontmatter in 7 commands, and share.md rewritten from README to command template
• 3 security improvements in 1 PR: pinned git clone to tag v0.6.3, fixed sed delimiter clash, added public-deployment warning to share.sh
• Security scan: CLEAR (no Critical/High findings)
• Audit score: 66/100 (expected to improve to ~91/100 after merges)

[xiaolai]

Contribution run complete — nicobailon/visual-explainer

Audit score: 66/100 | Security: CLEAR | Bugs fixed: 9

Pull Requests

PR	Title	Fingerprints
#43	Add missing name field to 7 command frontmatter blocks	7 findings
#47	Rewrite share.md as proper command template	2 findings
#45	Harden install-pi.sh sed delimiter + public-deploy warning	2 findings

Tracking Issue

nicobailon/visual-explainer#48 — full audit summary with all bug details and PR links.