Home / acmesh-official / acme.sh
AI Slop Code RIsk Monitor

acmesh-official/acme.sh

A pure Unix shell script ACME client for SSL / TLS certificate automation

4.6 Low pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for acmesh-official/acme.sh, a Shell project with 47,805 GitHub stars. SynthScan examined 71,037 lines of code across 329 source files, recording 190 pattern matches distributed across 9 syntactic categories. The legacy adjusted pattern signal is 4.6 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

4.6
Adjusted Signal
4.6
Raw Pattern Score
100%
Time Factor
2026-10-09
Last Push
47.8K
Stars
Shell
Language
71.0K
Lines of Code
329
Files
190
Pattern Hits
2026-10-12
Scan Date
0.01
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 13.7/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 156 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.4/100 · LOW

Are imports declared and package/API names verified? 3 finding(s).

Agent Over-Engineering Ratio 6.9/100 · LOW

Are wrappers, guards, and repeated structures necessary? 31 finding(s).

PR Review Velocity Impact 18.8/100 · LOW

Which changes need focused human review? 190 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 3MEDIUM 45LOW 142

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 190 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Decorative Section Separators28 hits · 96 pts
SeverityFileLineSnippetContext
MEDIUMdeploy/truenas_websocat.sh18# ---------------------------------------------------------------------------COMMENT
MEDIUMdeploy/truenas_websocat.sh20# ---------------------------------------------------------------------------COMMENT
MEDIUMdeploy/truenas_websocat.sh40# ---------------------------------------------------------------------------COMMENT
MEDIUMdeploy/truenas_ws.sh15# ------------------------------------------------COMMENT
MEDIUM⚡deploy/byteplus_alb.sh49# ══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUM⚡deploy/byteplus_alb.sh51# ══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUM⚡deploy/byteplus_alb.sh56# ══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUM⚡deploy/byteplus_alb.sh58# ══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUM⚡deploy/byteplus_alb.sh190 # ── 5. Save new CertificateId for next renewal ───────────────────────────────COMMENT
MEDIUM⚡deploy/byteplus_alb.sh198# ══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUM⚡deploy/byteplus_alb.sh200# ══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUM⚡deploy/byteplus_alb.sh212# ══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUM⚡deploy/byteplus_alb.sh214# ══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUM⚡deploy/byteplus_alb.sh224# ══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUM⚡deploy/byteplus_alb.sh226# ══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUMdeploy/byteplus_alb.sh12# ┌─────────────────────────────────────────────────────────────────────┐COMMENT
MEDIUMdeploy/byteplus_alb.sh23# └─────────────────────────────────────────────────────────────────────┘COMMENT
MEDIUMdeploy/byteplus_alb.sh73 # ── 1. Load & validate credentials ──────────────────────────────────────────COMMENT
MEDIUMdeploy/byteplus_alb.sh138 # ── 2. Build certificate name ────────────────────────────────────────────────COMMENT
MEDIUMdeploy/byteplus_alb.sh163 # ── 3. Read cert and key ─────────────────────────────────────────────────────COMMENT
MEDIUMdeploy/byteplus_alb.sh174 # ── 4. Deploy: first-time upload or renewal replace ─────────────────────────COMMENT
MEDIUMdeploy/byteplus_alb.sh254# ══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUMdeploy/byteplus_alb.sh256# ══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUMdeploy/byteplus_alb.sh274# ══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUMdeploy/byteplus_alb.sh276# ══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUMdeploy/byteplus_alb.sh388# ══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUMdeploy/byteplus_alb.sh390# ══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUMdnsapi/dns_inwx.sh13# -------------COMMENT
Over-Commented Block96 hits · 94 pts
SeverityFileLineSnippetContext
LOWacme.sh2541#Is this status the CA's front end failing rather than its ACMECOMMENT
LOWacme.sh2561#was serving that morning. Waiting is the answer, not abandoning an orderCOMMENT
LOWacme.sh6441COMMENT
LOWacme.sh6581 . "$DOMAIN_CONF"COMMENT
LOWnotify/smtp.sh1#!/usr/bin/env shCOMMENT
LOWnotify/bark.sh1#!/usr/bin/env shCOMMENT
LOWnotify/dingtalk.sh41 # DINGTALK_SIGNING_KEY=""COMMENT
LOWnotify/aws_ses.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/jetkvm.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/jetkvm.sh21# JetKVM's "Custom" TLS mode (device web UI: Settings > Network > HTTPSCOMMENT
LOWdeploy/jetkvm.sh41#COMMENT
LOWdeploy/jetkvm.sh61# The following variables exported from environment will be used. If notCOMMENT
LOWdeploy/jetkvm.sh221 return 0COMMENT
LOWdeploy/vault.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/directadmin.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/edgio.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/unifios.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/unifios.sh21# The API is served on the management port, which differs per install:COMMENT
LOWdeploy/unifios.sh41# Auth: POST /api/auth/login returns a `TOKEN` cookie containing a JWT whoseCOMMENT
LOWdeploy/unifios.sh61# the new certificate before it removes any old entries. If a failureCOMMENT
LOWdeploy/unifios.sh101 # _normalizeJson collapses the response to one line. This removes extraCOMMENT
LOWdeploy/unifios.sh201 if [ -z "$_uos_csrf" ]; thenCOMMENT
LOWdeploy/unifios.sh241 _create_code="$(_uos_response_code)"COMMENT
LOWdeploy/haproxy.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/haproxy.sh21# It is strongly recommended to set this something that makes senseCOMMENT
LOWdeploy/haproxy.sh41#COMMENT
LOWdeploy/consul.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/vault_cli.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/multideploy.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/multideploy.sh21# Dependencies:COMMENT
LOWdeploy/multideploy.sh201# Description:COMMENT
LOWdeploy/localcopy.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/cpanel_uapi.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/netlify.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/keyhelp.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/lighttpd.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/lighttpd.sh21# It is strongly recommended to set this something that makes senseCOMMENT
LOWdeploy/unifi.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/unifi.sh21# The deploy-hook automatically detects standard Unifi installationsCOMMENT
LOWdeploy/unifi.sh41# (same setting as above, default is updated when running on Cloud Key Gen1):COMMENT
LOWdeploy/windows_rdp.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/windows_rdp.sh101 cat <<PSEOFCOMMENT
LOWdeploy/ssh.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/ssh.sh21# export DEPLOY_SSH_FULLCHAIN=""COMMENT
LOWdeploy/panos.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/truenas_websocat.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/truenas_websocat.sh21#COMMENT
LOWdeploy/truenas_websocat.sh41COMMENT
LOWdeploy/zyxel_gs1900.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/zyxel_gs1900.sh21# Current GS1900 Switch Compatibility:COMMENT
LOWdeploy/zyxel_gs1900.sh41#COMMENT
LOWdeploy/mydevil.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/baidu_cdn.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/truenas_ws.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/truenas_ws.sh21# export DEPLOY_TRUENAS_HOSTNAME="<TRUENAS_HOSTNAME_OR_IP>"COMMENT
LOWdeploy/truenas_ws.sh101# 0: trueCOMMENT
LOWdeploy/truenas_ws.sh141 doneCOMMENT
LOWdeploy/synology_dsm.sh1#!/usr/bin/env shCOMMENT
LOWdeploy/synology_dsm.sh21# - export SYNO_HOSTNAME="localhost" - defaults to "localhost"COMMENT
LOWdeploy/fortigate.sh1#!/usr/bin/env shCOMMENT
36 more matches not shown…
Redundant / Tautological Comments29 hits · 45 pts
SeverityFileLineSnippetContext
LOWdeploy/kemplm.sh55 # Check if certificate is already installedCOMMENT
LOWdeploy/haproxy.sh259 # Check if issuer cert is also a root CA certCOMMENT
LOW⚡deploy/multideploy.sh87 # Check if yq is installedCOMMENT
LOW⚡deploy/multideploy.sh94 # Check if deploy file existsCOMMENT
LOWdeploy/multideploy.sh158 # Check if extracted services exist in services listCOMMENT
LOWdeploy/multideploy.sh161 # Check if service existsCOMMENT
LOWdeploy/kong.sh61 #Check if sslcreated (if not => POST else => PATCH)COMMENT
LOWdeploy/lighttpd.sh207 # Check if issuer cert is also a root CA certCOMMENT
LOWdeploy/truenas.sh219 # Check if the app use the same certificate TrueNAS web UICOMMENT
LOW⚡deploy/byteplus_alb.sh185 # Check if deploy step set _new_cert_idCOMMENT
LOWdnsapi/dns_sotoon.sh63 # Check if there are existing TXT records for this subdomainCOMMENT
LOWdnsapi/dns_sotoon.sh78 # Check if this exact TXT value already exists (avoid duplicates)COMMENT
LOWdnsapi/dns_sotoon.sh143 # Check if there are existing TXT records for this subdomainCOMMENT
LOWdnsapi/dns_sotoon.sh211 # Check if the response contains our domainCOMMENT
LOWdnsapi/dns_sotoon.sh225 # Check if the hyphenated name exists in the responseCOMMENT
LOWdnsapi/dns_sotoon.sh229 # Check if the origin itself is used as nameCOMMENT
LOWdnsapi/dns_infoblox_uddi.sh63 # Check if record already existsCOMMENT
LOWdnsapi/dns_infoblox_uddi.sh178 # Check if response contains results (even if empty)COMMENT
LOWdnsapi/dns_bunny.sh22 # Check if API Key is setCOMMENT
LOWdnsapi/dns_bunny.sh79 # Check if API Key ExistsCOMMENT
LOWdnsapi/dns_subreg.sh116# Check if the current $response contains a successful status in the ns2:Map format:COMMENT
LOWdnsapi/dns_cyon.sh229 # Check if we got an error response (JSON) instead of HTMLCOMMENT
LOWdnsapi/dns_dgon.sh21 # Check if API Key ExistsCOMMENT
LOWdnsapi/dns_dgon.sh76 # Check if API Key ExistsCOMMENT
LOWdnsapi/dns_one.sh33 #Check if the TXT existsCOMMENT
LOWdnsapi/dns_one.sh71 #Check if the TXT existsCOMMENT
LOWdnsapi/dns_huaweicloud.sh162 # Check if retry count is reachedCOMMENT
LOWdnsapi/dns_huaweicloud.sh247 # Check if record existCOMMENT
LOWdnsapi/dns_mgwm.sh76 # Check if credentials are setCOMMENT
Self-Referential Comments14 hits · 42 pts
SeverityFileLineSnippetContext
MEDIUMacme.sh8234 # Create the custom cert home now instead of on first issuance, so theCOMMENT
MEDIUMdeploy/haproxy.sh196 # Create a temporary PEM fileCOMMENT
MEDIUMdeploy/lighttpd.sh144 # Create a temporary PEM fileCOMMENT
MEDIUMdeploy/panos.sh27# This function is to parse the XML response from the firewallCOMMENT
MEDIUMdeploy/panos.sh58#This function is used to deploy to the firewallCOMMENT
MEDIUMdnsapi/dns_bunny.sh14## Create the text record for validation.COMMENT
MEDIUMdnsapi/dns_bhosted.sh349# Create a unique config key for cached record idsCOMMENT
MEDIUMdnsapi/dns_dgon.sh13## Create the text record for validation.COMMENT
MEDIUMdnsapi/dns_ali.sh13# This file is referenced by Alibaba Cloud Services deploy hooksCOMMENT
MEDIUMdnsapi/dns_online.sh159 # Creating a dummy record in this temporary version, because online.net doesn't accept enabling an empty versionCOMMENT
MEDIUMdnsapi/dns_mgwm.sh16# This function is called by acme.sh to add a TXT record.COMMENT
MEDIUMdnsapi/dns_mgwm.sh36# This function is called by acme.sh to remove a TXT record after validation.COMMENT
MEDIUMdnsapi/dns_mgwm.sh87 # Create the Basic Auth Header. acme.sh's _base64 function is used for encoding.COMMENT
MEDIUMdnsapi/dns_hw.sh38 # Create a TXT record set: https://support.huaweicloud.com/api-dns/dns_api_64001.htmlCOMMENT
Example Usage Blocks15 hits · 23 pts
SeverityFileLineSnippetContext
LOW⚡deploy/multideploy.sh84# Usage:COMMENT
LOWdeploy/multideploy.sh132# Usage:COMMENT
LOWdeploy/multideploy.sh186# Usage:COMMENT
LOWdeploy/multideploy.sh214# Usage:COMMENT
LOWdeploy/multideploy.sh234# Usage:COMMENT
LOWdeploy/multideploy.sh276# Usage:COMMENT
LOWdeploy/zyxel_gs1900.sh37# Usage:COMMENT
LOWdeploy/truenas_ws.sh30# Usage:COMMENT
LOWdeploy/truenas_ws.sh92# Usage:COMMENT
LOWdeploy/truenas_ws.sh113# Usage:COMMENT
LOWdnsapi/dns_bookmyname.sh25# Usage:COMMENT
LOWdnsapi/dns_eurodns.sh20# Usage:COMMENT
LOWdnsapi/dns_glesys.sh20# Usage:COMMENT
LOWdnsapi/dns_glesys.sh71# Usage:COMMENT
LOWdnsapi/dns_laodc.sh12# Usage:COMMENT
Magic Placeholder Names3 hits · 20 pts
SeverityFileLineSnippetContext
HIGHdnsapi/dns_ipprojects.sh54 _err "e.g.: export IPP_Apikey=\"your_api_key\""CODE
HIGHdnsapi/dns_eurodns.sh22# export EURODNS_API_KEY="your-api-key"COMMENT
HIGHdnsapi/dns_laodc.sh13# export LaoDC_Key="your-api-key"COMMENT
Excessive Try-Catch Wrapping3 hits · 5 pts
SeverityFileLineSnippetContext
LOWacme.sh3146 except Exception:CODE
MEDIUMnotify/smtp.sh344 print("Error sending: %r" % err)CODE
MEDIUMnotify/smtp.sh348 print("Error connecting to %s:%d: %r" % (smtp_host, smtp_port, err))CODE
AI Slop Vocabulary1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMdeploy/unifios.sh35# code path the UI uses, so it's far more robust than editing settings.yaml,COMMENT
Slop Phrases1 hit · 2 pts
SeverityFileLineSnippetContext
LOWdnsapi/dns_namecheap.sh15# Due to Namecheap's API limitation all the records of your domain will be read and re applied, make sure to have a backCOMMENT