AI Slop Code Risk Monitor

arkime/arkime

SlopCodeMonitor badge for arkime/arkime Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

Arkime is an open source, large scale, full packet capturing, indexing, and database system.

1.0 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for arkime/arkime, a C project with 7,554 GitHub stars. SynthScan examined 282,379 lines of code across 689 source files, recording 182 pattern matches distributed across 13 syntactic categories. The legacy adjusted pattern signal is 1.0 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

1.0
Adjusted Signal
1.0
Raw Pattern Score
100%
Time Factor
2026-10-30
Last Push
7.6K
Stars
C
Language
282.4K
Lines of Code
689
Files
182
Pattern Hits
2026-10-31
Scan Date
0.01
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 2.2/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 121 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.9/100 · LOW

Are imports declared and package/API names verified? 23 finding(s).

Agent Over-Engineering Ratio 2.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 50 finding(s).

PR Review Velocity Impact 5.1/100 · LOW

Which changes need focused human review? 182 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 2HIGH 2MEDIUM 43LOW 135

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 182 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Decorative Section Separators38 hits · 114 pts
SeverityFileLineSnippetContext
MEDIUMtests/gen/gen_adb_synthetic.py239 # ==========================================================================COMMENT
MEDIUMtests/gen/gen_adb_synthetic.py243 # ==========================================================================COMMENT
MEDIUMtests/gen/gen_adb_synthetic.py273 # ==========================================================================COMMENT
MEDIUMtests/gen/gen_adb_synthetic.py278 # ==========================================================================COMMENT
MEDIUMtests/gen/gen_adb_synthetic.py329 # ==========================================================================COMMENT
MEDIUMtests/gen/gen_adb_synthetic.py333 # ==========================================================================COMMENT
MEDIUMtests/gen/gen_adb_synthetic.py359 # ==========================================================================COMMENT
MEDIUMtests/gen/gen_adb_synthetic.py364 # ==========================================================================COMMENT
MEDIUMtests/gen/gen_adb_synthetic.py387 # ==========================================================================COMMENT
MEDIUMtests/gen/gen_adb_synthetic.py392 # ==========================================================================COMMENT
MEDIUMtests/gen/gen_adb_synthetic.py415 # ==========================================================================COMMENT
MEDIUMtests/gen/gen_adb_synthetic.py419 # ==========================================================================COMMENT
MEDIUMtests/gen/gen_adb_synthetic.py435 # ==========================================================================COMMENT
MEDIUMtests/gen/gen_adb_synthetic.py439 # ==========================================================================COMMENT
MEDIUMtests/gen/gen_ntlm_synthetic.py41# -------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_ntlm_synthetic.py43# -------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_ntlm_synthetic.py139# -------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_ntlm_synthetic.py141# -------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_ntlm_synthetic.py200# -------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_ntlm_synthetic.py202# -------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_ntlm_synthetic.py343# -------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_ntlm_synthetic.py345# -------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_ntlm_synthetic.py387# -------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_ntlm_synthetic.py389# -------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_ntlm_synthetic.py433# -------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_ntlm_synthetic.py435# -------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_ntlm_synthetic.py473# -------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_ntlm_synthetic.py475# -------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_ntlm_synthetic.py776# -------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_ntlm_synthetic.py778# -------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_opcua_synthetic.py28# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_opcua_synthetic.py30# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_opcua_synthetic.py94# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_opcua_synthetic.py96# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_opcua_synthetic.py136# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_opcua_synthetic.py138# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_opcua_synthetic.py277# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/gen/gen_opcua_synthetic.py279# ---------------------------------------------------------------------------COMMENT
Over-Commented Block92 hits · 84 pts
SeverityFileLineSnippetContext
LOWeasybutton-build.sh1#!/usr/bin/env bashCOMMENT
LOWcapture/python.c1/******************************************************************************/COMMENT
LOWcapture/dedup.c21 * non-matches. MD5 is used over XXH3 to keep the function smallCOMMENT
LOWcapture/main.c1/******************************************************************************/COMMENT
LOWcapture/field.c21#define ARKIME_FIELD_SPECIAL_MIN_SAVE -4COMMENT
LOWcapture/reader-tpacketv3.c301#endif // TPACKET_V3COMMENT
LOWcapture/db.c1/******************************************************************************/COMMENT
LOWcapture/arkime.h1/******************************************************************************/COMMENT
LOWcapture/arkime.h21#include "http_parser.h"COMMENT
LOWcapture/arkime.h41#define SUPPRESS_ALIGNMENT __attribute__((no_sanitize_undefined()))COMMENT
LOWcapture/arkime.h61#define ARKIME_SESSIONID6_LEN 40COMMENT
LOWcapture/arkime.h301#define ARKIME_COND_INIT(var) pthread_cond_init(&var##_cond, NULL)COMMENT
LOWcapture/arkime.h761COMMENT
LOWcapture/arkime.h1521typedef uint32_t (* ArkimePluginOutstandingFunc)();COMMENT
LOWcapture/arkime.h1821#define strcat(x,y) BANNED(strcat, g_strlcat)COMMENT
LOWcapture/arkime.h1841#define asctime(t) BANNED(asctime, none)COMMENT
LOWcapture/parsers/dns.c1/* Copyright 2012-2017 AOL Inc. All rights reserved.COMMENT
LOWcapture/parsers/adb.c1/* Copyright 2012-2017 AOL Inc. All rights reserved.COMMENT
LOWcapture/parsers/adb.c21#define ADB_AUTH_RSAPUBLICKEY 3COMMENT
LOWcapture/parsers/bacnet.c21#define BVLC_TYPE_BACNET_IP 0x81COMMENT
LOWcapture/parsers/sctp.c1/* sctp.cCOMMENT
LOWcapture/parsers/tcp.c341COMMENT
LOWcapture/parsers/smb.c41#define SMB1_DELETE 11COMMENT
LOWcapture/parsers/stun.c41#define TURN_ALLOCATE_RESPONSE 0x0103COMMENT
LOWcapture/parsers/stun.c61#define STUN_ATTR_DATA 0x0013COMMENT
LOWcapture/plugins/wise.c61COMMENT
LOWcapture/plugins/lua/molua.h21 uint8_t invalid; // True if the pointer is no longer validCOMMENT
LOWcapture/plugins/kafka/kafka.c1/* kafka.c -- Simple plugin that sends json encoded data to KafkaCOMMENT
LOWcapture/thirdparty/xxhash.h321 */COMMENT
LOWcapture/thirdparty/xxhash.h361 * They will then be redefined for XXH_INLINE_ALLCOMMENT
LOWcapture/thirdparty/xxhash.h381# undef XXH64_copyStateCOMMENT
LOWcapture/thirdparty/xxhash.h401# undef XXH3_128bits_withSeedCOMMENT
LOWcapture/thirdparty/xxhash.h421 * Alternative solution: do not redeclare them.COMMENT
LOWcapture/thirdparty/xxhash.h441#endif /* XXH_INLINE_ALL || XXH_PRIVATE_API */COMMENT
LOWcapture/thirdparty/xxhash.h461COMMENT
LOWcapture/thirdparty/xxhash.h481# define XXH64_copyState XXH_IPREF(XXH64_copyState)COMMENT
LOWcapture/thirdparty/xxhash.h501# define XXH128 XXH_IPREF(XXH128)COMMENT
LOWcapture/thirdparty/xxhash.h521***************************************/COMMENT
LOWcapture/thirdparty/xxhash.h861 || (defined (__STDC_VERSION__) && (__STDC_VERSION__ >= 199901L) /* C99 */) )COMMENT
LOWcapture/thirdparty/xxhash.h1701# define XXH_ALIGN(n) _Alignas(n)COMMENT
LOWcapture/thirdparty/xxhash.h2301 /* default to 1 for -Os or -Oz */COMMENT
LOWcapture/thirdparty/xxhash.h2321# if XXH_SIZE_OPT >= 1 || defined(__NO_INLINE__) /* -O0, -fno-inline */COMMENT
LOWcapture/thirdparty/xxhash.h2421COMMENT
LOWcapture/thirdparty/xxhash.h2441# define XXH_FORCE_INLINE static __forceinlineCOMMENT
LOWcapture/thirdparty/xxhash.h2461# define XXH3_WITH_SECRET_INLINE XXH_NO_INLINECOMMENT
LOWcapture/thirdparty/xxhash.h2501# include <assert.h> /* note: can still be disabled with NDEBUG */COMMENT
LOWcapture/thirdparty/xxhash.h2541#elseCOMMENT
LOWcapture/thirdparty/xxhash.h2561# elseCOMMENT
LOWcapture/thirdparty/xxhash.h2801# define XXH_rotl64 __builtin_rotateleft64COMMENT
LOWcapture/thirdparty/xxhash.h3461 * @defgroup XXH64_impl XXH64 implementationCOMMENT
LOWcapture/thirdparty/xxhash.h3841# define XXH_likely(x) (x)COMMENT
LOWcapture/thirdparty/xxhash.h3861# if defined(__ARM_NEON__) || defined(__ARM_NEON) \COMMENT
LOWcapture/thirdparty/xxhash.h4001# elif defined(__ARM_FEATURE_SVE)COMMENT
LOWcapture/thirdparty/xxhash.h4021# endifCOMMENT
LOWcapture/thirdparty/xxhash.h4041# define XXH_ACC_ALIGN 64 /* for compatibility with avx512 */COMMENT
LOWcapture/thirdparty/xxhash.h4061# define XXH_ACC_ALIGN 64 /* could be 8, but 64 may be faster */COMMENT
LOWcapture/thirdparty/xxhash.h4281# elif defined(__VEC_ELEMENT_REG_ORDER__) && __VEC_ELEMENT_REG_ORDER__ == __ORDER_BIG_ENDIAN__COMMENT
LOWcapture/thirdparty/xxhash.h4361 acc = svadd_u64_x(mask, acc, mul); \COMMENT
LOWcapture/thirdparty/xxhash.h4901# define ACC_NB XXH_ACC_NBCOMMENT
LOWcapture/thirdparty/xxhash.h5841 #define XXH_CONCAT2(X, Y) X ## YCOMMENT
32 more matches not shown…
Hallucination Indicators2 hits · 25 pts
SeverityFileLineSnippetContext
CRITICALviewer/public/jquery-jvectormap-1.2.2.min.js7 */(function(e){var t={set:{colors:1,values:1,backgroundColor:1,scaleColors:1,normalizeFunction:1,focus:1},get:{selectedCOMMENT
CRITICALviewer/vueapp/src/components/sessions/Sessions.vue923 return this.$store.state.user.settings.timelineDataFilters.map(i => FieldService.getField(i));CODE
Hyper-Verbose Identifiers12 hits · 12 pts
SeverityFileLineSnippetContext
LOWtests/gen/gen_tcpseq_synthetic.py40def sec_out_of_window_rst_syn():CODE
LOWtests/gen/gen_arkime_synthetic.py717def sec_dns_https_trailing_empty_param():CODE
LOWtests/gen/gen_arkime_synthetic.py3096def sec_quic_duplicate_crypto():CODE
LOWtests/gen/gen_arkime_synthetic.py3113def sec_udp_tunnel_port_fallback():CODE
LOWtests/gen/gen_arkime_synthetic.py3174def sec_http_upgrade_not_switched():CODE
LOWtests/gen/gen_arkime_synthetic.py3461def sec_http_connect_variants():CODE
LOWtests/gen/gen_arkime_synthetic.py3639def sec_dtls_fragmented_hello():CODE
LOWtests/gen/gen_arkime_synthetic.py3928def sec_http_connect_split_line():CODE
LOWtests/gen/gen_arkime_synthetic.py3944def sec_http_connect_smtp_guess():CODE
LOWcont3xt/vueapp/src/utils/cont3xtUtil.js61export function shouldDisplayIntegrationBtn (integration, integrationData) {CODE
LOWcont3xt/vueapp/src/utils/cont3xtUtil.js65export function shouldDisplayCountedIntegrationBtn (integration, integrationData) {CODE
LOW…/src/components/search/ExpressionAutocompleteInput.vue371function updateFieldHistoryResults (strToMatch) {CODE
Unused Imports11 hits · 11 pts
SeverityFileLineSnippetContext
LOWtests/plugins/pythonpacketcb.py1CODE
LOWtests/plugins/pythontest.py3CODE
LOWtests/plugins/pythontest.py4CODE
LOWtests/gen/gen_s7comm_synthetic.py13CODE
LOWtests/gen/gen_tcp-reassembly-synthetic.py13CODE
LOWtests/gen/gen_openvpn_synthetic.py13CODE
LOWtests/gen/gen_ike-cert_synthetic.py13CODE
LOWtests/gen/gen_diameter_synthetic.py13CODE
LOWtests/gen/gen_dnp3_synthetic.py13CODE
LOWtests/gen/gen_dcerpc_synthetic.py13CODE
LOWtests/gen/gen_pana_synthetic.py13CODE
Redundant / Tautological Comments7 hits · 10 pts
SeverityFileLineSnippetContext
LOWeasybutton-build.sh178# Check if in right directoryCOMMENT
LOWeasybutton-build.sh181# Check if gitCOMMENT
LOWrelease/docker.sh134# Check if no arguments were providedCOMMENT
LOWcontrib/netflow2arkime.pl148 # Check if stdin has dataCOMMENT
LOWcontrib/netflow2arkime.pl639# Check if flow is reverse direction of anotherCOMMENT
LOWcontrib/netflow2arkime.pl667 # Check if this is the reverse directionCOMMENT
LOWcontrib/netflow2arkime.pl1111 # Check if nfdump is available (use list-form to avoid shell interpretation of $NFDUMP_PATH)COMMENT
Self-Referential Comments3 hits · 9 pts
SeverityFileLineSnippetContext
MEDIUMtests/plugins/pythontest.py6# Create a new field in the session we will be settingCOMMENT
MEDIUMrelease/freebsdpkg.sh74# Create the package without -r flag, using absolute paths in plistCOMMENT
MEDIUMdb/db.pl4433# Create the template sessions use and update mapping of current sessions.COMMENT
Fake / Example Data8 hits · 8 pts
SeverityFileLineSnippetContext
LOWcapture/python.c571 int dummy_value; // Example placeholder for session-specific dataCODE
LOWcapture/python.c1239 state->dummy_value = 0; // Initialize dummy valueCODE
LOWcapture/python.c1297 int dummy_value; // Example placeholder for packet-specific dataCODE
LOWcapture/python.c1702 state->dummy_value = 0; // Initialize dummy valueCODE
LOW…/src/components/search/ExpressionAutocompleteInput.vue10 :placeholder="placeholder"CODE
LOW…/src/components/search/ExpressionAutocompleteInput.vue22 :placeholder="placeholder"CODE
LOWparliament/parliament.example.json6 "description": "This is the description of the cluster group. Lorem ipsum dolor sit amet, consectetur adipiscing eCODE
LOWparliament/parliament.example.json6 "description": "This is the description of the cluster group. Lorem ipsum dolor sit amet, consectetur adipiscing eCODE
Cross-Language Confusion2 hits · 5 pts
SeverityFileLineSnippetContext
HIGHtests/gen/gen_opcua_synthetic.py15 5. IPv6 - HEL EndpointUrl length=-1 (null)STRING
HIGHtests/gen/gen_opcua_synthetic.py46 """HEL Final. endpoint_url may be None (null), '' (empty) or a str."""STRING
Slop Phrases2 hits · 4 pts
SeverityFileLineSnippetContext
LOWcapture/plugins/taggerUpload.pl3# a database key, so make sure to reuse the same filename.COMMENT
MEDIUMviewer/public/cyberchef.html11<meta charset=UTF-8><title>CyberChef</title><meta name=copyright content="Crown Copyright 2016-2026"><meta name=descriptCODE
AI Slop Vocabulary2 hits · 3 pts
SeverityFileLineSnippetContext
LOWviewer/apiMisc.js266 const msg = 'Need to set https://arkime.com/settings#uploadcommand in config file for uploads to work. However if CODE
MEDIUMviewer/package-lock.json467 "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.2.tgz",CODE
Deep Nesting2 hits · 2 pts
SeverityFileLineSnippetContext
LOWtests/gen/gen_tcpseq_synthetic.py104CODE
LOWtests/gen/gen_tcpseq_synthetic.py136CODE
Example Usage Blocks1 hit · 2 pts
SeverityFileLineSnippetContext
LOWcontrib/netflow2arkime.pl17# Usage:COMMENT