Audit candidate: kingbootoshi/cartographer

[github-actions]

Repo

https://github.com/kingbootoshi/cartographer

Field	Value
Stars	590
NL Artifacts	2

Next Steps

1. Review the repo — check CONTRIBUTING.md, recent activity, PR history
2. If worthy: add label audit-ready to trigger the audit workflow
3. If not: close this issue

Checklist

• Accepts contributions
• Updated in last 60 days
• Not a fork or mirror
• Has meaningful NL artifacts

[github-actions]

Security Gate: BLOCKED

Critical security patterns detected in 1 file(s).
High-risk patterns in 0 file(s).

This repo will be audited for NL quality but will NOT receive automated PRs.
Manual security review required before any contributions.

[github-actions]

Security Gate: BLOCKED

Critical security patterns detected in 1 file(s).
High-risk patterns in 0 file(s).

This repo will be audited for NL quality but will NOT receive automated PRs.
Manual security review required before any contributions.

[github-actions]

Audit Complete: kingbootoshi/cartographer

NL Score: 85/100 | Security: REVIEW | Artifacts: 2 | Strategy: single

NLPM Audit: kingbootoshi/cartographer

Date: 2026-06-20 | Artifacts: 2 | Strategy: single
NL Score: 85/100
Security: REVIEW
Bugs: 1 | Quality Issues: 3 | Security Findings: 3

NL Score Summary

File	Type	Score	Top Issue
plugins/cartographer/.claude-plugin/plugin.json	plugin manifest	75/100	Missing version field (BUG: breaks marketplace registration)
plugins/cartographer/skills/cartographer/SKILL.md	skill	94/100	Vague quantifiers: "significant", "notable", "non-obvious" (-6)

Security Scan

Severity	Count
Critical	0
High	0
Medium	1
Low	2

Note on pre-scan CRITICAL flag: The pre-scan matched curl -LsSf https://astral.sh/uv/install.sh | sh in scan-codebase.py. After reading the file, this string appears inside a print(..., file=sys.stderr) statement at line 26 — advisory text the script emits when tiktoken is missing, not executed code. The CRITICAL classification is a false positive; the script never calls subprocess, os.system, or any shell. Reclassified as LOW (recommends insecure install pattern to users).

Execution Surface Inventory

Surface	Files
Scripts (Python)	plugins/cartographer/skills/cartographer/scripts/scan-codebase.py
Package manifest	package.json
Hooks	none
MCP configs	none

Security Findings

#	Severity	File	Line	Pattern	Description
1	LOW (FP at CRITICAL)	plugins/cartographer/skills/cartographer/scripts/scan-codebase.py	26	curl-pipe-sh	curl | sh string in a print(..., file=sys.stderr) advisory; not executed by script — false positive at CRITICAL; recommends insecure install pattern to users
2	MEDIUM	plugins/cartographer/skills/cartographer/SKILL.md	53	unpinned-runtime-install	pip install tiktoken with no version constraint; agent may install a future breaking or malicious version
3	LOW	plugins/cartographer/skills/cartographer/scripts/scan-codebase.py	4	unpinned-dependency	Inline UV script dependency tiktoken has no version pin; arbitrary future versions allowed at runtime

Bugs (PR-worthy)

#	File	Issue	Impact
1	plugins/cartographer/.claude-plugin/plugin.json	Missing version field	Plugin cannot be published to or resolved by the Claude Code marketplace; versioned installs (nlpm@0.x) break without this field

Security Fixes (PR-worthy, Medium/Low only)

#	File	Issue	Suggested Fix
1	plugins/cartographer/skills/cartographer/SKILL.md	pip install tiktoken without version pin (lines 53, 291)	Replace with pip install 'tiktoken>=0.7,<1.0' to prevent supply-chain drift
2	plugins/cartographer/skills/cartographer/scripts/scan-codebase.py	Inline UV dependency tiktoken unpinned (line 4)	Change to "tiktoken>=0.7,<1.0" in the # dependencies = [...] inline spec
3	plugins/cartographer/skills/cartographer/scripts/scan-codebase.py	Error message recommends curl | sh (line 26)	Replace with a versioned release download or pip install tiktoken (already shown on the next lines)

Quality Issues (informational)

---

Full report: https://github.com/xiaolai/nlpm/blob/main/auditor/audits/kingbootoshi-cartographer.md

4 bug(s) found. To submit fix PRs to the target repo, add the contribute-approved label to this issue.

[xiaolai]

PRs opened on kingbootoshi/cartographer:

• fix: add missing version field to plugin.json kingbootoshi/cartographer#7 — fix: add missing version field to plugin.json
• fix: pin tiktoken version to >=0.7,<1.0 kingbootoshi/cartographer#8 — fix: pin tiktoken version to >=0.7,<1.0

[github-actions]

No high-confidence findings — no PRs opened

The audit produced no findings at confidence: high.
Medium / low / unspecified-confidence findings are kept in
the audit data for our own learning but never become PRs.
This keeps maintainers free of unverified suggestions.