Home / QLHazyCoder / FlowPilot
AI Slop Code RIsk Monitor

QLHazyCoder/FlowPilot

Chrome扩展：支持GPT（Codex） / kiro / Grok自动注册、相关反代项目（CPA/Sub）回调上传

13.6 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for QLHazyCoder/FlowPilot, a JavaScript project with 5,179 GitHub stars. SynthScan examined 224,401 lines of code across 411 source files, recording 3306 pattern matches distributed across 8 syntactic categories. The legacy adjusted pattern signal is 13.6 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

13.6
Adjusted Signal
13.6
Raw Pattern Score
100%
Time Factor
2026-10-09
Last Push
5.2K
Stars
JavaScript
Language
224.4K
Lines of Code
411
Files
3.3K
Pattern Hits
2026-10-12
Scan Date
0.01
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 46.0/100 · MEDIUM

Can maintainers explain intent, assumptions, and trade-offs? 3045 finding(s).

Hallucinated Dependency & Supply Chain Risk 5.3/100 · LOW

Are imports declared and package/API names verified? 244 finding(s).

Agent Over-Engineering Ratio 45.6/100 · MEDIUM

Are wrappers, guards, and repeated structures necessary? 3022 finding(s).

PR Review Velocity Impact 52.4/100 · HIGH

Which changes need focused human review? 3306 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 4MEDIUM 2LOW 3300

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 3306 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers3005 hits · 2702 pts
SeverityFileLineSnippetContext
LOWmanaged-alias-utils.js3})(typeof self !== 'undefined' ? self : globalThis, function createManagedAliasUtilsModule() {CODE
LOWmanaged-alias-utils.js66 function getManagedAliasProviderConfig(provider = '') {CODE
LOWmanaged-alias-utils.js80 function usesManagedAliasGeneration(provider = '', options = {}) {CODE
LOWmanaged-alias-utils.js105 function parseManagedAliasBaseEmail(rawValue, provider = '') {CODE
LOWmanaged-alias-utils.js147 function getManagedAliasProviderUiCopy(provider = '') {CODE
LOWhotmail-utils.js29 function normalizeHotmailServiceMode(rawValue = '') {CODE
LOWhotmail-utils.js39 function extractCodeByRulePatterns(text, patterns = []) {CODE
LOWhotmail-utils.js88 function extractVerificationCodeFromMessage(message = {}, options = {}) {CODE
LOW⚡hotmail-utils.js111 function getHotmailListToggleLabel(expanded, count = 0) {CODE
LOW⚡hotmail-utils.js117 function filterHotmailAccountsByUsage(accounts, mode = 'all') {CODE
LOW⚡hotmail-utils.js125 function getHotmailBulkActionLabel(mode = 'all', count = 0) {CODE
LOW⚡hotmail-utils.js132 function isAuthorizedHotmailAccount(account) {CODE
LOW⚡hotmail-utils.js139 function shouldClearHotmailCurrentSelection(account) {CODE
LOW⚡hotmail-utils.js143 function upsertHotmailAccountInList(accounts, nextAccount) {CODE
LOWhotmail-utils.js237 function pickVerificationMessageWithFallback(messages, filters = {}) {CODE
LOWhotmail-utils.js246 function pickVerificationMessageWithTimeFallback(messages, filters = {}) {CODE
LOWhotmail-utils.js299 function normalizeHotmailMailApiMessage(message = {}) {CODE
LOWhotmail-utils.js333 function normalizeHotmailMailApiMessages(messages) {CODE
LOWhotmail-utils.js340 function buildHotmailMailApiLatestUrl(options = {}) {CODE
LOWhotmail-utils.js359 function getHotmailVerificationPollConfig(step) {CODE
LOWhotmail-utils.js379 function getHotmailVerificationRequestTimestamp(step, state = {}, options = {}) {CODE
LOWhotmail-utils.js399 function getHotmailMailApiRequestConfig() {CODE
LOWpaypal-utils.js35 function upsertPayPalAccountInList(accounts = [], nextAccount = null) {CODE
LOWcloudflare-temp-email-utils.js1(function cloudflareTempEmailUtilsModule(root, factory) {CODE
LOWcloudflare-temp-email-utils.js8})(typeof self !== 'undefined' ? self : globalThis, function createCloudflareTempEmailUtils() {CODE
LOWcloudflare-temp-email-utils.js21 function normalizeCloudflareTempEmailBaseUrl(rawValue = '') {CODE
LOWcloudflare-temp-email-utils.js37 function normalizeCloudflareTempEmailDomain(rawValue = '') {CODE
LOWcloudflare-temp-email-utils.js49 function normalizeCloudflareTempEmailDomains(values) {CODE
LOWcloudflare-temp-email-utils.js61 function normalizeCloudflareTempEmailSubdomainPrefix(rawValue = '') {CODE
LOWcloudflare-temp-email-utils.js74 function buildCloudflareTempEmailEffectiveDomain(config = {}) {CODE
LOWcloudflare-temp-email-utils.js84 function buildCloudflareTempEmailHeaders(config = {}, options = {}) {CODE
LOWcloudflare-temp-email-utils.js103 function joinCloudflareTempEmailUrl(baseUrl, path) {CODE
LOWcloudflare-temp-email-utils.js110 function getCloudflareTempEmailMailRows(payload) {CODE
LOWcloudflare-temp-email-utils.js149 function normalizeCloudflareTempEmailAddress(value) {CODE
LOWcloudflare-temp-email-utils.js319 function getCharsetFromContentType(contentType = '') {CODE
LOWcloudflare-temp-email-utils.js324 function getBoundaryFromContentType(contentType = '') {CODE
LOWcloudflare-temp-email-utils.js425 function normalizeReceivedDateTime(value) {CODE
LOWcloudflare-temp-email-utils.js436 function normalizeCloudflareTempEmailMessage(row = {}) {CODE
LOWcloudflare-temp-email-utils.js572 function normalizeCloudflareTempEmailMailApiMessages(payload) {CODE
LOWcloudflare-temp-email-utils.js578 function getCloudflareTempEmailAddressFromResponse(payload = {}) {CODE
LOW⚡background.js323function getRegistrationEmailBaseline(state = {}, options = {}) {CODE
LOW⚡background.js333function buildFlowRegistrationEmailStateUpdates(state = {}, options = {}) {CODE
LOW⚡background.js340function getPreservedPhoneIdentity(state = {}) {CODE
LOW⚡background.js347function buildStateViewWithRuntimeState(state = {}) {CODE
LOW⚡background.js868function normalizeAuthRecoveryIdentifierType(value = '') {CODE
LOW⚡background.js873function isPhoneSignupAuthRecoveryState(state = {}) {CODE
LOW⚡background.js878function getPhoneSignupAuthRecoveryIdentity(state = {}) {CODE
LOW⚡background.js2196function isCurrentAutoRunSessionId(value) {CODE
LOW⚡background.js2201function throwIfAutoRunSessionStopped(sessionId) {CODE
LOW⚡background.js2209function normalizeAutoRunTimerPlan(plan) {CODE
LOW⚡background.js2895function normalizeStepExecutionRangeFlowId(value = '', fallback = DEFAULT_ACTIVE_FLOW_ID) {CODE
LOW⚡background.js2904function hasStepExecutionRangeShape(value) {CODE
LOW⚡background.js2914function normalizePositiveStepNumber(value, fallback = 0) {CODE
LOW⚡background.js2923function normalizeStepExecutionRangeEntry(value = {}) {CODE
LOW⚡background.js4295function broadcastIcloudAliasesChanged(payload = {}) {CODE
LOW⚡background.js4302function normalizePhoneIdentityDigits(value = '') {CODE
LOW⚡background.js4306function getPhoneActivationPhoneNumber(activation = null) {CODE
LOW⚡background.js4644function getLuckmailPreserveTagInfo(state = {}) {CODE
LOW⚡background.js4651async function setLuckmailUsedPurchasesState(usedPurchases) {CODE
LOW⚡background.js4659async function setLuckmailPurchaseUsedState(purchaseId, used) {CODE
2945 more matches not shown…
Fake / Example Data244 hits · 246 pts
SeverityFileLineSnippetContext
LOWsidepanel/i18n-static.js518 const TRANSLATABLE_ATTRS = Object.freeze(['title', 'aria-label', 'placeholder', 'data-show-label', 'data-hide-label'])CODE
LOWsidepanel/sidepanel.html853 <input type="text" id="input-cloud-mail-admin-email" class="data-input" placeholder="admin@example.com" />CODE
LOWtests/cloudflare-temp-email-utils.test.js94 address: 'user@example.com',CODE
LOWtests/cloudflare-temp-email-utils.test.js110 assert.equal(messages[0].address, 'user@example.com');CODE
LOWtests/cloudflare-temp-email-utils.test.js121 address: 'user@example.com',CODE
LOWtests/background-message-router-step2-skip.test.js244 email: 'user@example.com',CODE
LOWtests/background-message-router-step2-skip.test.js248 assert.deepStrictEqual(events.emailStates, ['user@example.com']);CODE
LOW⚡tests/background-message-router-step2-skip.test.js281 email: 'user@example.com',CODE
LOW⚡tests/background-message-router-step2-skip.test.js283 accountIdentifier: 'user@example.com',CODE
LOW⚡tests/background-message-router-step2-skip.test.js286 assert.deepStrictEqual(events.emailStates, ['user@example.com']);CODE
LOWtests/background-message-router-step2-skip.test.js369 email: 'user@example.com',CODE
LOWtests/background-message-router-step2-skip.test.js374 assert.deepStrictEqual(events.emailStates, ['user@example.com']);CODE
LOW⚡tests/background-message-router-step2-skip.test.js517 email: 'user@example.com',CODE
LOW⚡tests/background-message-router-step2-skip.test.js525 email: 'user@example.com',CODE
LOW⚡tests/background-message-router-step2-skip.test.js531 assert.deepStrictEqual(events.emailStates, ['user@example.com']);CODE
LOW⚡tests/background-message-router-step2-skip.test.js538 email: 'user@example.com',CODE
LOWtests/background-message-router-step2-skip.test.js639 email: 'user@example.com',CODE
LOWtests/sidepanel-phone-verification-settings.test.js718 accountIdentifier: 'user@example.com',CODE
LOWtests/sidepanel-phone-verification-settings.test.js720 email: 'user@example.com',CODE
LOWtests/sidepanel-paypal-manager.test.js93 openFormDialog: async () => ({ email: 'user@example.com', password: 'secret' }),CODE
LOWtests/sidepanel-paypal-manager.test.js106 email: 'user@example.com',CODE
LOWtests/sidepanel-paypal-manager.test.js116 email: 'user@example.com',CODE
LOWtests/sidepanel-paypal-manager.test.js151 assert.equal(latestState.paypalEmail, 'user@example.com');CODE
LOWtests/step6-oauth-consent-skip.test.js130 return step6_login({ email: 'user@example.com' });CODE
LOWtests/background-mail-rule-registry-module.test.js37 email: 'user@example.com',CODE
LOWtests/background-mail-rule-registry-module.test.js67 targetEmail: 'user@example.com',CODE
LOWtests/background-mail-rule-registry-module.test.js68 targetEmailHints: ['user@example.com', 'user=example.com'],CODE
LOWtests/background-mail-rule-registry-module.test.js79 email: 'user@example.com',CODE
LOWtests/background-mail-rule-registry-module.test.js134 email: 'user@example.com',CODE
LOWtests/sidepanel-contribution-mode.test.js207const inputSub2ApiEmail = { value: 'user@example.com' };CODE
LOWtests/sidepanel-contribution-mode.test.js387 email: 'user@example.com',CODE
LOWtests/background-sub2api-agent-identity-import.test.js97 sub2apiEmail: 'admin@example.com',CODE
LOWtests/background-grok-state-module.test.js66 assert.equal(view.grokEmail, 'user@example.com');CODE
LOWtests/background-grok-state-module.test.js82 assert.equal(view.runtimeState.flowState.grok.register.email, 'user@example.com');CODE
LOWtests/background-flow-mail-polling-module.test.js27 targetEmail: 'user@example.com',CODE
LOWtests/background-flow-mail-polling-module.test.js43 state: { activeFlowId: 'kiro', email: 'user@example.com' },CODE
LOWtests/background-flow-mail-polling-module.test.js146 targetEmail: 'user@example.com',CODE
LOWtests/background-flow-mail-polling-module.test.js184 assert.equal(mailMessage.payload.targetEmail, 'user@example.com');CODE
LOW⚡tests/background-paypal-account-store-module.test.js76 assert.equal(account.email, 'user@example.com');CODE
LOW⚡tests/background-paypal-account-store-module.test.js81 assert.equal(latestState.paypalEmail, 'user@example.com');CODE
LOW⚡tests/background-paypal-account-store-module.test.js87 paypalEmail: 'user@example.com',CODE
LOWtests/step6-timeout-recovery.test.js229 email: 'user@example.com',CODE
LOWtests/verification-flow-polling.test.js113 email: 'user@example.com',CODE
LOWtests/verification-flow-polling.test.js123 targetEmail: 'user@example.com',CODE
LOWtests/verification-flow-polling.test.js159 const step4Payload = helpers.getVerificationPollPayload(4, { email: 'user@example.com', mailProvider: '2925' });CODE
LOWtests/verification-flow-polling.test.js160 const step8Payload = helpers.getVerificationPollPayload(8, { email: 'user@example.com', mailProvider: '2925' });CODE
LOWtests/verification-flow-polling.test.js180 { email: 'user@example.com', mailProvider: 'icloud', lastSignupCode: null },CODE
LOWtests/verification-flow-polling.test.js210 { email: 'user@example.com', mailProvider: 'icloud', lastLoginCode: null },CODE
LOWtests/verification-flow-polling.test.js259 email: 'user@example.com',CODE
LOWtests/verification-flow-polling.test.js264 email: 'user@example.com',CODE
LOWtests/verification-flow-polling.test.js322 { email: 'user@example.com', lastLoginCode: null },CODE
LOWtests/verification-flow-polling.test.js387 email: 'user@example.com',CODE
LOWtests/verification-flow-polling.test.js451 email: 'user@example.com',CODE
LOWtests/verification-flow-polling.test.js521 email: 'user@example.com',CODE
LOWtests/verification-flow-polling.test.js590 { email: 'user@example.com', lastLoginCode: null },CODE
LOWtests/verification-flow-polling.test.js668 { email: 'user@example.com', lastLoginCode: null },CODE
LOWtests/verification-flow-polling.test.js776 email: 'user@example.com',CODE
LOWtests/verification-flow-polling.test.js840 email: 'user@example.com',CODE
LOWtests/verification-flow-polling.test.js904 email: 'user@example.com',CODE
LOWtests/verification-flow-polling.test.js974 email: 'user@example.com',CODE
184 more matches not shown…
Structural Annotation Overuse18 hits · 31 pts
SeverityFileLineSnippetContext
LOW项目完整链路说明.md467### Step 4 / Step 8COMMENT
LOW⚡background.js14343// Step 1: Open ChatGPT homepageCOMMENT
LOW⚡background.js14351// Step 2: Click signup, fill email, continue to password pageCOMMENT
LOW⚡background.js14359// Step 3: Fill Password (via openai-auth.js)COMMENT
LOW⚡background.js14367// Step 4: Get Signup Verification Code (qq-mail.js polls, then fills in openai-auth.js)COMMENT
LOW⚡background.js14521// Step 5: Fill Name & Birthday (via openai-auth.js)COMMENT
LOW⚡background.js14529// Step 7: Login and ensure the auth page reaches the login verification pageCOMMENT
LOW⚡background.js15405// Step 7: Refresh OAuth and log inCOMMENT
LOW⚡background.js15413// Step 8: Poll login verification mail and submit the login codeCOMMENT
LOW⚡background.js15421// Step 9: 完成 OAuth（自动点击 + localhost 回调监听）COMMENT
LOWbackground.js16040// Step 10: 平台回调验证COMMENT
LOWcontent/qq-mail.js111 // Step 1: Snapshot existing mail IDs BEFORE we start waiting for new emailCOMMENT
LOWflows/openai/content/vps-panel.js948// Step 1: Get OAuth LinkCOMMENT
LOWflows/openai/content/openai-auth.js2669// Step 2: Click Register, fill email, then continue to password pageCOMMENT
LOWflows/openai/content/openai-auth.js2681// Step 3: Fill PasswordCOMMENT
LOWflows/openai/content/openai-auth.js5795// Step 7: Login with registered account (on OAuth auth page)COMMENT
LOWflows/openai/content/openai-auth.js6996// Step 9: Find "继续" on OAuth consent page for debugger clickCOMMENT
LOWflows/openai/content/openai-auth.js7186// Step 5: Fill Name & Birthday / AgeCOMMENT
Verbosity Indicators17 hits · 29 pts
SeverityFileLineSnippetContext
LOW⚡background.js14343// Step 1: Open ChatGPT homepageCOMMENT
LOW⚡background.js14351// Step 2: Click signup, fill email, continue to password pageCOMMENT
LOW⚡background.js14359// Step 3: Fill Password (via openai-auth.js)COMMENT
LOW⚡background.js14367// Step 4: Get Signup Verification Code (qq-mail.js polls, then fills in openai-auth.js)COMMENT
LOW⚡background.js14521// Step 5: Fill Name & Birthday (via openai-auth.js)COMMENT
LOW⚡background.js14529// Step 7: Login and ensure the auth page reaches the login verification pageCOMMENT
LOW⚡background.js15405// Step 7: Refresh OAuth and log inCOMMENT
LOW⚡background.js15413// Step 8: Poll login verification mail and submit the login codeCOMMENT
LOW⚡background.js15421// Step 9: 完成 OAuth（自动点击 + localhost 回调监听）COMMENT
LOWbackground.js16040// Step 10: 平台回调验证COMMENT
LOWcontent/qq-mail.js111 // Step 1: Snapshot existing mail IDs BEFORE we start waiting for new emailCOMMENT
LOWflows/openai/content/vps-panel.js948// Step 1: Get OAuth LinkCOMMENT
LOWflows/openai/content/openai-auth.js2669// Step 2: Click Register, fill email, then continue to password pageCOMMENT
LOWflows/openai/content/openai-auth.js2681// Step 3: Fill PasswordCOMMENT
LOWflows/openai/content/openai-auth.js5795// Step 7: Login with registered account (on OAuth auth page)COMMENT
LOWflows/openai/content/openai-auth.js6996// Step 9: Find "继续" on OAuth consent page for debugger clickCOMMENT
LOWflows/openai/content/openai-auth.js7186// Step 5: Fill Name & Birthday / AgeCOMMENT
Empty Error Handlers4 hits · 20 pts
SeverityFileLineSnippetContext
HIGHscripts/custom_mail_helper.py421except KeyboardInterrupt:CODE
HIGHscripts/custom_mail_helper.py288except Exception:CODE
HIGHscripts/hotmail_helper.py884except KeyboardInterrupt:CODE
HIGHscripts/hotmail_helper.py528except Exception:CODE
Excessive Try-Catch Wrapping13 hits · 14 pts
SeverityFileLineSnippetContext
LOWscripts/custom_mail_helper.py81 except Exception as exc:CODE
LOWscripts/custom_mail_helper.py134 except Exception:CODE
LOWscripts/custom_mail_helper.py162 except Exception as exc:CODE
LOWscripts/custom_mail_helper.py189 except Exception:STRING
LOWscripts/custom_mail_helper.py288 except Exception:STRING
LOWscripts/custom_mail_helper.py410 except Exception as exc:STRING
MEDIUMscripts/custom_mail_helper.py382def do_POST(self):CODE
LOWscripts/hotmail_helper.py91 except Exception as exc:CODE
LOWscripts/hotmail_helper.py463 except Exception:CODE
LOWscripts/hotmail_helper.py528 except Exception:CODE
LOWscripts/hotmail_helper.py697 except Exception as exc:CODE
LOWscripts/hotmail_helper.py872 except Exception as exc:CODE
MEDIUMscripts/hotmail_helper.py802def do_POST(self):CODE
Deep Nesting3 hits · 3 pts
SeverityFileLineSnippetContext
LOWscripts/custom_mail_helper.py254CODE
LOWscripts/hotmail_helper.py498CODE
LOWscripts/hotmail_helper.py705CODE
Over-Commented Block2 hits · 2 pts
SeverityFileLineSnippetContext
LOWcontent/qq-mail.js1// content/qq-mail.js — Content script for QQ Mail (steps 4, 7)COMMENT
LOWflows/openai/content/vps-panel.js1// flows/openai/content/vps-panel.js — Content script for CPA panel (OAuth URL request / platform verification node)COMMENT