Audit candidate: LukeRenton/explore-claude-code

[github-actions]

Repo

https://github.com/LukeRenton/explore-claude-code

Field	Value
Stars	237
NL Artifacts	25

Next Steps

1. Review the repo — check CONTRIBUTING.md, recent activity, PR history
2. If worthy: add label audit-ready to trigger the audit workflow
3. If not: close this issue

Checklist

• Accepts contributions
• Updated in last 60 days
• Not a fork or mirror
• Has meaningful NL artifacts

[github-actions]

Audit Complete: LukeRenton/explore-claude-code

NL Score: 89/100 | Security: REVIEW | Artifacts: 27 | Strategy: batched

NLPM Audit: LukeRenton/explore-claude-code

Date: 2026-04-06 | Artifacts: 27 | Strategy: batched
NL Score: 89/100
Security: REVIEW
Bugs: 4 | Quality Issues: 37 | Security Findings: 1

NL Score Summary

File	Type	Score	Top Issue
.claude/agents/engineers/orchestrator-engineer.md	agent	65	Vague quantifiers capped at -20 (11 hits, mostly from copy-pasted generic memory-system boilerplate)
.claude/agents/engineers/engineering-frontend-developer.md	agent	75	Zero <example> blocks in description
.claude/agents/engineers/engineering-code-reviewer.md	agent	75	Zero <example> blocks in description
.claude/agents/engineers/engineering-backend-developer.md	agent	75	Zero <example> blocks in description
.claude/agents/engineers/engineering-software-architect.md	agent	75	Zero <example> blocks in description
site/content/.claude/plugins/my-plugin/.claude-plugin/plugin.json	plugin.json	75	File is not valid JSON (uses // comments)
.claude/skills/build-skill/SKILL.md	skill	82	No worked examples; 4 vague quantifiers
.claude/agents/core-planner.md	agent	83	Zero <example> blocks in description
.claude/agents/content-writing/content-writer.md	agent	83	Zero <example> blocks in description
site/content/.claude/commands/review-pr.md	command	83	No empty-input / error-path handling
.claude/skills/build-agent/SKILL.md	skill	84	No worked examples; 3 vague quantifiers
site/content/.claude/commands/my-command/my-command.md	command	85	No empty-input / error-path handling
site/content/.claude/commands/write-tests.md	command	85	No empty-input / error-path handling
.claude/skills/core-brainstorm/SKILL.md	skill	88	No worked examples
.claude/skills/frontend-design/SKILL.md	skill	90	No worked examples
CLAUDE.md	memory	95	No prerequisites/setup section
site/content/.claude/skills/my-skill/SKILL.md	skill (scaffold)	98	1 vague quantifier
site/content/built-in/commands/BUILT-IN-COMMANDS.md	doc	98	1 vague quantifier
site/content/.claude/agents/my-agent/my-agent.md	agent (scaffold)	100	none
site/content/.claude/agents/AGENTS.md	doc	100	none
site/content/built-in/commands/init/init.md	doc	100	none
site/content/built-in/commands/diff/diff.md	doc	100	none
site/content/built-in/commands/btw/btw.md	doc	100	none
site/content/built-in/commands/rewind/rewind.md	doc	100	none
site/content/built-in/commands/compact/compact.md	doc	100	none
site/content/.claude/commands/COMMANDS.md	doc	100	none
site/content/CLAUDE.md	doc	100	none (see Cross-Component: this file also functions as a real, auto-loaded CLAUDE.md)

Scoring notes:

• site/content/** files are a self-referential "teaching website" corpus: most are documentation about Claude Code artifact types, not functioning artifacts themselves (e.g. init.md, diff.md, btw.md, rewind.md, compact.md, AGENTS.md, COMMANDS.md, BUILT-IN-COMMANDS.md describe built-in features and have no frontmatter by design). These were scored as documentation, not against the Agent/Command/Skill rubrics.
• Three files (my-agent.md, my-command.md's explanatory half, my-skill/SKILL.md) are explicit "starter/scaffolding" templates whose bodies literally say "this is a starter file." Their placeholder/generic description text was not penalized under R04-style genericness rules, since genericness is the intended teaching device, not a defect.
• .claude/agents/** and .claude/skills/** (repo root) are this project's own real operating agents/skills (its actual .claude/ config) and were scored at full rigor.

Security Scan

Severity	Count
Critical	0
High	0
Medium	1

---

Full report: https://github.com/xiaolai/nlpm/blob/main/auditor/audits/LukeRenton-explore-claude-code.md

5 bug(s) found. To submit fix PRs to the target repo, add the contribute-approved label to this issue.

[xiaolai]

Opened 2 PRs on LukeRenton/explore-claude-code after independently reproducing each bug:

• fix: use project-relative memory path in orchestrator-engineer agent LukeRenton/explore-claude-code#5 — hardcoded personal Windows path in the orchestrator-engineer agent's memory system
• fix: remove bypassPermissions from shared settings.json LukeRenton/explore-claude-code#6 — bypassPermissions removed from the shared, committed .claude/settings.json

Dropped the three "invalid JSON via // comments" findings (plugin.json, marketplace.json, .mcp.json) even though each one reproducibly fails JSON.parse. The comments are the site's only in-place teaching content for those sections (.mcp.json in particular has no companion doc anywhere on the site), so stripping them to achieve strict JSON validity would be a content-priority call for the maintainer to make, not a mechanical fix.