Audit candidate: dongbeixiaohuo/writing-agent

[github-actions]

Repo

https://github.com/dongbeixiaohuo/writing-agent

Field	Value
Stars	312
NL Artifacts	72

Next Steps

1. Review the repo — check CONTRIBUTING.md, recent activity, PR history
2. If worthy: add label audit-ready to trigger the audit workflow
3. If not: close this issue

Checklist

• Accepts contributions
• Updated in last 60 days
• Not a fork or mirror
• Has meaningful NL artifacts

[github-actions]

Audit Complete: dongbeixiaohuo/writing-agent

NL Score: 82/100 | Security: BLOCKED | Artifacts: 72 | Strategy: progressive

NLPM Audit: dongbeixiaohuo/writing-agent

Date: 2026-04-06 | Artifacts: 72 | Strategy: progressive
NL Score: 82/100
Security: BLOCKED
Bugs: 3 | Quality Issues: 51 | Security Findings: 5

Notes on repo structure

This repo ships every agent/skill/hook in three mirrored locations:
.claude/ (dev), claude-runtime/ (documented as the sync source-of-truth —
see scripts/sync_claude_runtime.py / check_claude_runtime_sync.py), and
plugins/writing-agent/ (the distributable plugin). diff -rq confirms all
20 agents and 3 skills are byte-identical across the three copies; only
hooks/hooks.json legitimately differs (the plugin copy adds a
SessionStart bootstrap hook and uses ${CLAUDE_PLUGIN_ROOT}-relative
paths). Because of this, every NL finding below is real in triplicate (one
occurrence per copy — 60 agent-path rows + 9 skill-path rows in the score
table), but is reported once, anchored at the claude-runtime/ copy
(the documented sync source), to keep the tables actionable. Fixing the
claude-runtime/ copy and running python scripts/sync_claude_runtime.py
propagates the fix to the other two automatically.

NL Score Summary

File	Type	Score	Top Issue
.claude/agents/writing-executor.md	agent	74	No <example> blocks (-15); model not declared (-5)
claude-runtime/agents/writing-executor.md	agent	74	No <example> blocks (-15); model not declared (-5)
plugins/writing-agent/agents/writing-executor.md	agent	74	No <example> blocks (-15); model not declared (-5)
.claude/agents/humanizer.md	agent	77	No <example> blocks (-15); model not declared (-5)
claude-runtime/agents/humanizer.md	agent	77	No <example> blocks (-15); model not declared (-5)
plugins/writing-agent/agents/humanizer.md	agent	77	No <example> blocks (-15); model not declared (-5)
.claude/agents/article-illustrator.md	agent	79	No <example> blocks (-15); GenerateImage tool unused (-3)
claude-runtime/agents/article-illustrator.md	agent	79	No <example> blocks (-15); GenerateImage tool unused (-3)
plugins/writing-agent/agents/article-illustrator.md	agent	79	No <example> blocks (-15); GenerateImage tool unused (-3)
.claude/agents/writing-clarifier.md	agent	79	No <example> blocks (-15); Grep unused (-3)
claude-runtime/agents/writing-clarifier.md	agent	79	No <example> blocks (-15); Grep unused (-3)
plugins/writing-agent/agents/writing-clarifier.md	agent	79	No <example> blocks (-15); Grep unused (-3)
.claude/agents/outline-architect.md	agent	79	No <example> blocks (-15); Grep unused (-3)
claude-runtime/agents/outline-architect.md	agent	79	No <example> blocks (-15); Grep unused (-3)
plugins/writing-agent/agents/outline-architect.md	agent	79	No <example> blocks (-15); Grep unused (-3)
.claude/agents/fact-checker.md	agent	79	No <example> blocks (-15); Grep unused (-3)
claude-runtime/agents/fact-checker.md	agent	79	No <example> blocks (-15); Grep unused (-3)
plugins/writing-agent/agents/fact-checker.md	agent	79	No <example> blocks (-15); Grep unused (-3)
.claude/agents/topic-generator.md	agent	79	No <example> blocks (-15); Grep unused (-3)
claude-runtime/agents/topic-generator.md	agent	79	No <example> blocks (-15); Grep unused (-3)
plugins/writing-agent/agents/topic-generator.md	agent	79	No <example> blocks (-15); Grep unused (-3)
.claude/agents/editor-review.md	agent	79	No <example> blocks (-15); Grep unused (-3)
claude-runtime/agents/editor-review.md	agent	79	No <example> blocks (-15); Grep unused (-3)
plugins/writing-agent/agents/editor-review.md	agent	79	No <example> blocks (-15); Grep unused (-3)
.claude/agents/research-expert.md	agent	79	No <example> blocks (-15); WebFetch unused (-3)

---

Full report: https://github.com/xiaolai/nlpm/blob/main/auditor/audits/dongbeixiaohuo-writing-agent.md

SECURITY BLOCKED: Critical/High security issues found. Do NOT submit automated PRs. Manual security review required.

[github-actions]

Security disclosure auto-filing failed (default GITHUB_TOKEN cannot create issues on third-party repos). Body queued at auditor/disclosures-pending/dongbeixiaohuo-writing-agent.md for manual filing.