nlpm
xiaolai/nlpmPlugin
NLPM lints, scores, fixes, and trend-tracks the natural-language artifacts that make up a Claude Code plugin — skills, agents, commands, rules, hooks, manifests — against a 50-rule rubric on a 100-point scale. Ships focused agents (scanner, scorer, checker, fixer, tester, security-scanner, vague-scanner, vocab-drift-scanner) and a standalone Python validator (bin/nlpm-check) that runs in pre-commit hooks and CI without Claude Code installed, plus a shields.io "Validated by NLPM" badge.
Why this score
Popularity score: 72/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank
Security
Scanned Oct 22, 2026 at commit 2b38d31fb5df, first 300 source files (it's a large repo), with Cisco's open-source skill-scanner.
What its code does:
- Runs shell commands Common for dev tools. Read the commands it runs.agents/security-scanner.md:1, auditor/audits/Q00-ouroboros.md:1, auditor/audits/evo-hq-evo.md:1 and 21 more
- Includes scripts in hidden folders Folders starting with a dot are easy to miss when you read a repo.auditor/audits/.gen_jsonl.py
A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan
Alternatives
Nothing from another maker does quite the same job yet.