5.0

Adjusted Signal

5.0

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

12.1K

Stars

TypeScript

Language

136.5K

Lines of Code

997

Files

133

Pattern Hits

2026-10-31

Scan Date

0.05

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 2.0/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 55 finding(s).

Hallucinated Dependency & Supply Chain Risk 17.4/100 · LOW

Are imports declared and package/API names verified? 52 finding(s).

Agent Over-Engineering Ratio 5.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 63 finding(s).

PR Review Velocity Impact 21.0/100 · LOW

Which changes need focused human review? 133 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 51HIGH 0MEDIUM 25LOW 57

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 133 distinct pattern matches across 6 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators51 hits · 520 pts

Severity	File	Line	Snippet	Context
CRITICAL	…ckages/napcat-onebot/action/extends/GetAiCharacters.ts	43	const rawList = await this.core.apis.PacketApi.pkt.operation.FetchAiVoiceList(+payload.group_id, chatTypeNum);	CODE
CRITICAL	…ckages/napcat-onebot/action/extends/RenameGroupFile.ts	42	await this.core.apis.PacketApi.pkt.operation.RenameGroupFile(+payload.group_id, contextMsgFile.fileUUID, payload.c	CODE
CRITICAL	packages/napcat-onebot/action/extends/MoveGroupFile.ts	42	await this.core.apis.PacketApi.pkt.operation.MoveGroupFile(+payload.group_id, contextMsgFile.fileUUID, payload.cur	CODE
CRITICAL	packages/napcat-onebot/action/extends/SendPacket.ts	35	const data = await this.core.apis.PacketApi.pkt.operation.sendPacket({ cmd: payload.cmd, data: packetData }, rsp);	CODE
CRITICAL	packages/napcat-onebot/action/extends/GetRkey.ts	24	return await this.core.apis.PacketApi.pkt.operation.FetchRkey();	CODE
CRITICAL	packages/napcat-onebot/action/extends/GetUserStatus.ts	34	const res = await this.core.apis.PacketApi.pkt.operation.GetStrangerStatus(+payload.user_id);	CODE
CRITICAL	…ckages/napcat-onebot/action/extends/SetSpecialTitle.ts	32	await this.core.apis.PacketApi.pkt.operation.SetGroupSpecialTitle(+payload.group_id, uid, payload.special_title);	CODE
CRITICAL	packages/napcat-onebot/action/extends/SetGroupSign.ts	27	return await this.core.apis.PacketApi.pkt.operation.GroupSign(+payload.group_id);	CODE
CRITICAL	packages/napcat-onebot/action/extends/GetMiniAppArk.ts	97	const arkData = await this.core.apis.PacketApi.pkt.operation.GetMiniAppAdaptShareInfo(reqParam);	CODE
CRITICAL	…t-onebot/action/extends/GetUnidirectionalFriendList.ts	55	const rsp_data = await this.core.apis.PacketApi.pkt.operation.sendPacket(rsq, true);	CODE
CRITICAL	packages/napcat-onebot/action/msg/SendMsg.ts	266	const transformedMsg = this.core.apis.PacketApi.pkt.msgConverter.rawMsgWithSendMsgToPacketMsg(packetMsgElements)	CODE
CRITICAL	packages/napcat-onebot/action/msg/SendMsg.ts	281	const transformedMsg = this.core.apis.PacketApi.pkt.msgConverter.rawMsgToPacketMsg(msg, msgPeer);	CODE
CRITICAL	packages/napcat-onebot/action/msg/SendMsg.ts	300	const rawActions = await this.core.apis.PacketApi.pkt.operation.FetchForwardMsgRaw(resId);	CODE
CRITICAL	packages/napcat-onebot/action/msg/SendMsg.ts	335	const resid = await this.core.apis.PacketApi.pkt.operation.UploadForwardMsgV2(uploadMsgData, msgPeer.chatType === Ch	CODE
CRITICAL	packages/napcat-onebot/action/file/GetGroupFileUrl.ts	35	url: await this.core.apis.PacketApi.pkt.operation.GetGroupFileUrl(+payload.group_id, contextMsgFile.fileUUID),	CODE
CRITICAL	packages/napcat-onebot/action/file/GetPrivateFileUrl.ts	39	url: await this.core.apis.PacketApi.pkt.operation.GetPrivateFileUrl(self_id, contextMsgFile.fileUUID, file_has	CODE
CRITICAL	…ckages/napcat-onebot/action/group/SendGroupAiRecord.ts	36	await this.core.apis.PacketApi.pkt.operation.GetAiVoice(+payload.group_id, payload.character, payload.text, AIVoiceC	CODE
CRITICAL	packages/napcat-onebot/action/group/GetAiRecord.ts	34	const rawRsp = await this.core.apis.PacketApi.pkt.operation.GetAiVoice(+payload.group_id, payload.character, payload	CODE
CRITICAL	packages/napcat-onebot/action/group/GetAiRecord.ts	38	return await this.core.apis.PacketApi.pkt.operation.GetGroupPttUrl(+payload.group_id, rawRsp.msgInfoBody[0].index);	CODE
CRITICAL	packages/napcat-onebot/action/group/DelEssenceMsg.ts	48	const data = this.core.apis.GroupApi.essenceLRU.getValue(+payload.message_id);	CODE
CRITICAL	…kages/napcat-onebot/action/group/SetGroupAddRequest.ts	36	const invite_notify = this.obContext.apis.MsgApi.notifyGroupInvite.get(flag);	CODE
CRITICAL	packages/napcat-onebot/action/group/GetGroupEssence.ts	100	this.core.apis.GroupApi.essenceLRU.set(shortId, msgTempData);	CODE
CRITICAL	packages/napcat-onebot/action/packet/SendPoke.ts	33	await this.core.apis.PacketApi.pkt.operation.SendPoke(is_group, +peer_id, +target_id);	CODE
CRITICAL	packages/napcat-onebot/action/packet/GetRkeyServer.ts	40	const rkeys = await this.core.apis.PacketApi.pkt.operation.FetchRkey();	CODE
CRITICAL	packages/napcat-onebot/action/packet/SetGroupTodo.ts	12	await this.core.apis.PacketApi.pkt.operation.SetGroupTodo(groupId, msgSeq);	CODE
CRITICAL	…kages/napcat-onebot/action/packet/CompleteGroupTodo.ts	13	await this.core.apis.PacketApi.pkt.operation.CompleteGroupTodo(groupId, msgSeq);	CODE
CRITICAL	packages/napcat-onebot/action/packet/CancelGroupTodo.ts	13	await this.core.apis.PacketApi.pkt.operation.CancelGroupTodo(groupId, msgSeq);	CODE
CRITICAL	packages/napcat-onebot/action/packet/GetRkeyEx.ts	31	const rkeys = await this.core.apis.PacketApi.pkt.operation.FetchRkey();	CODE
CRITICAL	packages/napcat-onebot/api/msg.ts	187	return await this.core.apis.PacketApi.pkt.operation.FetchRkey().then(() => true).catch(() => false);	CODE
CRITICAL	packages/napcat-onebot/api/msg.ts	417	? await this.core.apis.PacketApi.pkt.operation.FetchGroupMessage(+msg.peerUin, msgSeq, msgSeq)	CODE
CRITICAL	packages/napcat-onebot/api/msg.ts	418	: await this.core.apis.PacketApi.pkt.operation.FetchC2CMessage(msg.peerUid, msgSeq, msgSeq);	CODE
CRITICAL	packages/napcat-onebot/api/msg.ts	489	return await this.core.apis.PacketApi.pkt.operation.FetchRkey().then(() => true).catch(() => false);	CODE
CRITICAL	packages/napcat-onebot/api/msg.ts	532	return await this.core.apis.PacketApi.pkt.operation.FetchRkey().then(() => true).catch(() => false);	CODE
CRITICAL	packages/napcat-onebot/api/msg.ts	578	multiMsgs = await this.core.apis.PacketApi.pkt.operation.FetchForwardMsg(element.resId);	CODE
CRITICAL	packages/napcat-onebot/api/msg.ts	1414	const groupRole = this.core.apis.GroupApi.groupMemberCache.get(groupUin)?.get(this.core.selfInfo.uid.toString())?.ro	CODE
CRITICAL	packages/napcat-onebot/api/msg.ts	1496	this.core.apis.GroupApi.groupMemberCache.delete(groupChange.groupUin.toString());	CODE
CRITICAL	packages/napcat-onebot/api/msg.ts	1671	// console.log(this.core.apis.GroupApi.groupMemberCache.get(group)?.get(uid)?.memberSpecialTitle, new_title)	COMMENT
CRITICAL	packages/napcat-onebot/api/msg.ts	1672	// if (this.core.apis.GroupApi.groupMemberCache.get(group)?.get(uid)?.memberSpecialTitle == new_title) {	COMMENT
CRITICAL	packages/napcat-onebot/api/quick-action.ts	94	const invite_notify = this.obContext.apis.MsgApi.notifyGroupInvite.get(request.flag);	CODE
CRITICAL	packages/napcat-onebot/api/group.ts	142	this.obContext.core.context.packetHandler.onCmd('trpc.msg.olpush.OlPushService.MsgPush', async (packet) => {	CODE
CRITICAL	packages/napcat-onebot/api/group.ts	355	const old_members = structuredClone(this.core.apis.GroupApi.groupMemberCache.get(msg.peerUid));	CODE
CRITICAL	packages/napcat-core/apis/file.ts	45	const ret = await this.core.apis.PacketApi.pkt.operation.FetchRkey();	CODE
CRITICAL	packages/napcat-core/apis/file.ts	59	return this.core.apis.PacketApi.pkt.operation.GetGroupFileUrl(+peer, fileUUID, timeout);	CODE
CRITICAL	packages/napcat-core/apis/file.ts	61	return this.core.apis.PacketApi.pkt.operation.GetPrivateFileUrl(peer, fileUUID, file10MMd5, timeout);	CODE
CRITICAL	packages/napcat-core/apis/file.ts	75	return this.core.apis.PacketApi.pkt.operation.GetGroupPttUrl(+peer, {	CODE
CRITICAL	packages/napcat-core/apis/file.ts	83	return this.core.apis.PacketApi.pkt.operation.GetPttUrl(peer, {	CODE
CRITICAL	packages/napcat-core/apis/file.ts	103	return this.core.apis.PacketApi.pkt.operation.GetGroupVideoUrl(+peer, {	CODE
CRITICAL	packages/napcat-core/apis/file.ts	111	return this.core.apis.PacketApi.pkt.operation.GetVideoUrl(peer, {	CODE
CRITICAL	packages/napcat-test/qzoneCompatibility.test.ts	91	expect(core.apis.WebApi.uploadImageToQzone.mock.calls.map(args => args[0])).toEqual([	CODE
CRITICAL	packages/napcat-test/rpc.test.ts	847	expect(await client.level1.level2.level3.level4.level5.getValue()).toBe('deep-value');	CODE
CRITICAL	packages/napcat-test/rpc.test.ts	848	expect(await client.level1.level2.level3.level4.level5.getAsyncValue()).toBe('async-deep-value');	CODE

Decorative Section Separators25 hits · 104 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	.github/workflows/build-pr.yml	1	# =============================================================================	COMMENT
MEDIUM⚡	.github/workflows/build-pr.yml	3	# =============================================================================	COMMENT
MEDIUM⚡	.github/workflows/build-pr.yml	10	# =============================================================================	COMMENT
MEDIUM	.github/workflows/build-pr.yml	48	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/workflows/build-pr.yml	50	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/workflows/build-pr.yml	142	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/workflows/build-pr.yml	144	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/workflows/build-pr.yml	283	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/workflows/build-pr.yml	285	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	.github/workflows/release-publish.yml	129	# -----------------------------	COMMENT
MEDIUM⚡	.github/workflows/release-publish.yml	131	# -----------------------------	COMMENT
MEDIUM⚡	.github/workflows/release-publish.yml	136	# -----------------------------	COMMENT
MEDIUM⚡	.github/workflows/release-publish.yml	138	# -----------------------------	COMMENT
MEDIUM⚡	.github/workflows/release-publish.yml	143	# -----------------------------	COMMENT
MEDIUM⚡	.github/workflows/release-publish.yml	145	# -----------------------------	COMMENT
MEDIUM⚡	.github/workflows/release-publish.yml	149	# -----------------------------	COMMENT
MEDIUM⚡	.github/workflows/release-publish.yml	151	# -----------------------------	COMMENT
MEDIUM⚡	.github/workflows/release-publish.yml	154	# -----------------------------	COMMENT
MEDIUM⚡	.github/workflows/release-publish.yml	156	# -----------------------------	COMMENT
MEDIUM⚡	.github/workflows/release-publish.yml	167	# -----------------------------	COMMENT
MEDIUM⚡	.github/workflows/release-publish.yml	169	# -----------------------------	COMMENT
MEDIUM⚡	.github/workflows/release-publish.yml	174	# -----------------------------	COMMENT
MEDIUM⚡	.github/workflows/release-publish.yml	176	# -----------------------------	COMMENT
MEDIUM⚡	.github/workflows/release-publish.yml	181	# -----------------------------	COMMENT
MEDIUM⚡	.github/workflows/release-publish.yml	183	# -----------------------------	COMMENT

Hyper-Verbose Identifiers37 hits · 37 pts

Severity	File	Line	Snippet	Context
LOW	…pcat-onebot/action/extends/qzone-public/http-params.ts	2	export function decodeQzonePublicHttpParameters (parameters: unknown): Record<string, unknown> {	CODE
LOW	…/napcat-onebot/action/extends/qzone/common-snowluma.ts	152	export function normalizeQzoneFeedsPayload (value: unknown) {	CODE
LOW	…/napcat-onebot/action/extends/qzone/common-snowluma.ts	172	export function normalizeQzoneListPayload (value: unknown) {	CODE
LOW	…/napcat-onebot/action/extends/qzone/common-snowluma.ts	191	export function normalizeQzoneDetailPayload (value: unknown) {	CODE
LOW	…/napcat-onebot/action/extends/qzone/common-snowluma.ts	207	export function normalizeQzoneLikePayload (value: unknown) {	CODE
LOW	…/napcat-onebot/action/extends/qzone/common-snowluma.ts	238	export function normalizeQzoneCommentPayload (value: unknown) {	CODE
LOW	…s/napcat-onebot/action/extends/qzone/common-comment.ts	76	export function validateQzoneCommentReadPayload (payload: unknown, withParent: boolean): void {	CODE
LOW	…es/napcat-onebot/action/group/GroupOperationHelpers.ts	3	export function assertGroupManagementResults (	CODE
LOW	packages/napcat-core/data/qzone-rpc.ts	164	export function normalizeQzoneRichContent (value: unknown): string \| null {	CODE
LOW	packages/napcat-core/data/qzone-rpc.ts	202	export function normalizeQzoneMediaImages (value: unknown): string[] \| null {	CODE
LOW	packages/napcat-core/data/qzone-rpc.ts	242	export function validateQzoneFeedReference (value: unknown): QzoneFeedReference {	CODE
LOW	packages/napcat-core/data/group.ts	14	export function applyGroupManagementSettings (	CODE
LOW	packages/napcat-core/data/group.ts	72	export function createGroupManagementRequests (	CODE
LOW	packages/napcat-core/data/album.ts	140	export function createAlbumCommentRequest (	CODE
LOW	packages/napcat-core/data/webapi.ts	334	export function qunAlbumVideoCoverControl ({	CODE
LOW	packages/napcat-core/data/qzone-web.ts	88	function rejectDuplicateSuccessFields (text: string): void {	CODE
LOW	packages/napcat-core/data/qzone-web.ts	242	function hasObservedEmptyForwardContent (detail: Record<string, unknown>): boolean {	CODE
LOW	packages/napcat-core/data/qzone.ts	18	export function buildQzoneUploadImageBody (params: QzoneUploadImageParams): string {	CODE
LOW	packages/napcat-core/data/qzone.ts	66	export function parseQzoneUploadImageResponseText (raw: string): QzoneUploadImageRawResponse {	CODE
LOW	packages/napcat-core/data/qzone.ts	159	export function parseQzonePublishResponse (json: QzonePublishResponse): { tid: string; time: number; } {	CODE
LOW	packages/napcat-core/helper/ffmpeg/download-ffmpeg.ts	314	export async function downloadFFmpegIfNotExists (log: LogWrapper) {	CODE
LOW	packages/napcat-test/qzoneWebData.test.ts	120	function observedEmptyForwardFields (): Record<string, unknown> {	CODE
LOW	packages/napcat-image-size/src/index.ts	167	export function detectImageTypeFromBuffer (buffer: Buffer): ImageType {	CODE
LOW	packages/napcat-image-size/src/index.ts	213	export async function imageSizeFromBufferFallBack (	CODE
LOW	packages/napcat-rpc/src/transport.ts	154	export function createMessageServerHandler (target: unknown, options: {	CODE
LOW	packages/napcat-schema/index.ts	114	function isMeaninglessSuccessExampleData (value: unknown): boolean {	CODE
LOW	packages/napcat-schema/index.ts	118	function resolveCommonErrorExampleKey (error: { code: number, description: string; }): string \| null {	CODE
LOW	packages/napcat-schema/index.ts	150	function collapseSingleValueEnumCombinator (items: unknown[]): Record<string, unknown> \| null {	CODE
LOW	packages/napcat-schema/index.ts	336	function registerSchemasFromModule (	CODE
LOW	packages/napcat-schema/index.ts	378	function replaceComponentInlineSchemasWithRefs (openapi: JsonObject) {	CODE
LOW	packages/napcat-schema/index.ts	429	function replacePathInlineSchemasWithRefs (openapi: JsonObject) {	CODE
LOW	packages/napcat-common/src/helper.ts	97	export function getDefaultQQVersionConfigInfo (): QQVersionConfigType {	CODE
LOW	packages/napcat-common/src/mirror.ts	998	async function getArtifactsFromNightlyLink (	CODE
LOW	packages/napcat-framework/napcat.ts	255	function registerWebUiLoginCallbacks (	CODE
LOW	packages/napcat-webui-frontend/src/utils/typebox.ts	150	export function generateDefaultFromTypeBox (	CODE
LOW	.github/scripts/lib/comment.ts	286	export function generateDockerBuildingComment (prNumber: string, prSha: string): string {	CODE
LOW	.github/scripts/lib/comment.ts	325	export function generateDockerResultComment (	CODE

Over-Commented Block18 hits · 18 pts

Severity	File	Line	Snippet	Context
LOW	packages/napcat-webui-backend/src/router/Plugin.ts	41	// }	COMMENT
LOW	packages/napcat-webui-backend/src/router/QQLogin.ts	81	router.post('/GetGUIDBackups', QQGetGUIDBackupsHandler);	COMMENT
LOW	packages/napcat-webui-backend/src/router/QQLogin.ts	101	router.post('/GetLinuxMachineInfoBackups', QQGetLinuxMachineInfoBackupsHandler);	COMMENT
LOW	packages/napcat-onebot/action/stream/Readme.txt	1	# Stream-Api	COMMENT
LOW	packages/napcat-onebot/api/msg.ts	921	[OB11MessageDataType.node]: async () => undefined,	COMMENT
LOW	packages/napcat-onebot/api/msg.ts	1661	// }).decode(SysMessage.body?.msgContent.slice(7));	COMMENT
LOW	packages/napcat-onebot/api/msg.ts	1681	// this.core,	COMMENT
LOW	packages/napcat-onebot/api/group.ts	381	// if (grayTipElement.xmlElement.busiId === '10145') {	COMMENT
LOW	packages/napcat-core/adapters/NodeIDependsAdapter.ts	21	// pbBuffer: Uint8Array,	COMMENT
LOW	packages/napcat-core/services/NodeIKernelMSFService.ts	21	getNetworkProxy (): Promise<{	COMMENT
LOW	…es/napcat-core/services/NodeIKernelRichMediaService.ts	61	// public enum VideoRequestWay {	COMMENT
LOW	…napcat-core/services/NodeIKernelStorageCleanService.ts	1	import { NodeIKernelStorageCleanListener } from '@/napcat-core/listeners';	COMMENT
LOW	packages/napcat-test/Readme.md	1	# NapCat-Test	COMMENT
LOW	packages/napcat-framework/napcat.ts	181	if (!wrapperSession) throw new Error('QQ 未提供有效的 Framework Session');	COMMENT
LOW	…s/napcat-webui-frontend/src/pages/dashboard/plugin.tsx	101		COMMENT
LOW	…s/napcat-webui-frontend/src/pages/dashboard/plugin.tsx	121	// confirmText: '注册插件管理器',	COMMENT
LOW	…s/napcat-webui-frontend/src/pages/dashboard/plugin.tsx	141	// const file = e.target.files?.[0];	COMMENT
LOW	packages/napcat-shell/base.ts	821	// const result = dbApi.readDatabase('nt_msg.db');	COMMENT

Excessive Try-Catch Wrapping1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	…ages/napcat-onebot/action/stream/test_upload_stream.py	185	except Exception as e:	CODE

Unused Imports1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	…ages/napcat-onebot/action/stream/test_upload_stream.py	12		CODE

NapNeko/NapCatQQ

Open-Source Code Quality, Security and Technical Debt Review