1.7

Adjusted Signal

1.7

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

46.8K

Stars

Language

351.5K

Lines of Code

1.2K

Files

306

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 6.2/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 248 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.2/100 · LOW

Are imports declared and package/API names verified? 11 finding(s).

Agent Over-Engineering Ratio 1.9/100 · LOW

Are wrappers, guards, and repeated structures necessary? 47 finding(s).

PR Review Velocity Impact 7.5/100 · LOW

Which changes need focused human review? 306 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 3MEDIUM 115LOW 188

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 306 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Self-Referential Comments49 hits · 185 pts

Severity	File	Line	Snippet	Context
MEDIUM	.github/workflows/agentics-maintenance.yml	24	# This file defines the generated agentic maintenance workflow for this repository.	COMMENT
MEDIUM	…thub/workflows/scripts/spam-detection/eval-prompts.yml	2970	# Create a repository with a file so it has a default branch	COMMENT
MEDIUM	…thub/workflows/scripts/spam-detection/eval-prompts.yml	2976	# Create a fork	COMMENT
MEDIUM	…thub/workflows/scripts/spam-detection/eval-prompts.yml	2992	# Create the PR inside the fork	COMMENT
MEDIUM	…thub/workflows/scripts/spam-detection/eval-prompts.yml	4423	# Create a repository to act as upstream with a file so it has a default branch	COMMENT
MEDIUM	…thub/workflows/scripts/spam-detection/eval-prompts.yml	4431	# Create a fork in the same org	COMMENT
MEDIUM	…thub/workflows/scripts/spam-detection/eval-prompts.yml	4449	# Create the PR spanning upstream and fork repositories, gh pr create does not support headRepositoryId needed for	COMMENT
MEDIUM	…thub/workflows/scripts/spam-detection/eval-prompts.yml	4639	# Create a repository with a file so it has a default branch	COMMENT
MEDIUM	…thub/workflows/scripts/spam-detection/eval-prompts.yml	4645	# Create a fork	COMMENT
MEDIUM	…thub/workflows/scripts/spam-detection/eval-prompts.yml	4661	# Create the PR inside the fork	COMMENT
MEDIUM	…thub/workflows/scripts/spam-detection/eval-prompts.yml	4891	input: "<TITLE>\nLocal extensions can override core commands\n</TITLE>\n\n<BODY>\n### Describe the bug\n\n1. Local e	CODE
MEDIUM⚡	pkg/cmd/extension/command.go	587	# Create a script-based extension	COMMENT
MEDIUM⚡	pkg/cmd/extension/command.go	590	# Create a Go extension	COMMENT
MEDIUM⚡	pkg/cmd/extension/command.go	593	# Create a non-Go precompiled extension	COMMENT
MEDIUM	pkg/cmd/agent-task/agent_task.go	43	# Create a new agent task on the current repository	COMMENT
MEDIUM⚡	pkg/cmd/agent-task/create/create.go	87	# Create a task from an inline description	COMMENT
MEDIUM⚡	pkg/cmd/agent-task/create/create.go	90	# Create a task from an inline description and follow logs	COMMENT
MEDIUM⚡	pkg/cmd/agent-task/create/create.go	93	# Create a task from a file	COMMENT
MEDIUM⚡	pkg/cmd/agent-task/create/create.go	96	# Create a task with problem statement from stdin	COMMENT
MEDIUM⚡	pkg/cmd/agent-task/create/create.go	99	# Create a task with an editor	COMMENT
MEDIUM⚡	pkg/cmd/agent-task/create/create.go	102	# Create a task with an editor and a file as a template	COMMENT
MEDIUM⚡	pkg/cmd/agent-task/create/create.go	108	# Create a task using the custom agent defined in '.github/agents/my-agent.md'	COMMENT
MEDIUM	pkg/cmd/release/create/create.go	155	# Create a release and start a discussion	COMMENT
MEDIUM	pkg/cmd/release/create/create.go	158	# Create a release only if there are new commits available since the last release	COMMENT
MEDIUM	pkg/cmd/project/item-create/item_create.go	43	# Create a draft issue in the current user's project "1"	COMMENT
MEDIUM	pkg/cmd/project/field-create/field_create.go	44	# Create a field in the current user's project "1"	COMMENT
MEDIUM	pkg/cmd/project/field-create/field_create.go	47	# Create a field with three options to select from for owner monalisa	COMMENT
MEDIUM	pkg/cmd/project/create/create.go	40	# Create a new project owned by login monalisa	COMMENT
MEDIUM⚡	pkg/cmd/issue/develop/develop.go	66	# Create a branch for issue 123 based on the my-feature branch	COMMENT
MEDIUM⚡	pkg/cmd/issue/develop/develop.go	69	# Create a branch for issue 123 and check it out	COMMENT
MEDIUM⚡	pkg/cmd/issue/develop/develop.go	72	# Create a branch for issue 123 and check it out in a worktree	COMMENT
MEDIUM⚡	pkg/cmd/issue/develop/develop.go	75	# Create a branch in repo monalisa/cli for issue 123 in repo cli/cli	COMMENT
MEDIUM⚡	pkg/cmd/issue/artifact/create/create.go	127	# Create a document from a file	COMMENT
MEDIUM⚡	pkg/cmd/issue/artifact/create/create.go	133	# Create an HTML document from a file	COMMENT
MEDIUM⚡	pkg/cmd/issue/artifact/create/create.go	136	# Create a link with a name	COMMENT
MEDIUM⚡	pkg/cmd/issue/artifact/create/create.go	139	# Create a document from standard input	COMMENT
MEDIUM⚡	pkg/cmd/gist/create/create.go	65	# Create a gist with a description	COMMENT
MEDIUM⚡	pkg/cmd/gist/create/create.go	68	# Create a gist containing several files	COMMENT
MEDIUM⚡	pkg/cmd/gist/create/create.go	71	# Create a gist containing several files using patterns	COMMENT
MEDIUM⚡	pkg/cmd/gist/create/create.go	77	# Create a gist from output piped from another command	COMMENT
MEDIUM	pkg/cmd/repo/license/view/view.go	57	# Create a LICENSE.md with the MIT license	COMMENT
MEDIUM	pkg/cmd/repo/autolink/create/create.go	58	# Create an alphanumeric autolink to example.com for the key prefix "TICKET-".	COMMENT
MEDIUM	pkg/cmd/repo/autolink/create/create.go	62	# Create a numeric autolink to example.com for the key prefix "STORY-".	COMMENT
MEDIUM⚡	pkg/cmd/repo/create/create.go	107	# Create a repository interactively	COMMENT
MEDIUM⚡	pkg/cmd/repo/create/create.go	110	# Create a new remote repository and clone it locally	COMMENT
MEDIUM⚡	pkg/cmd/repo/create/create.go	113	# Create a new remote repository in a different organization	COMMENT
MEDIUM⚡	pkg/cmd/repo/create/create.go	116	# Create a remote repository from the current directory	COMMENT
MEDIUM	pkg/cmd/repo/gitignore/view/view.go	49	# Create a new .gitignore file using the Go template	COMMENT
MEDIUM	pkg/cmd/repo/gitignore/view/view.go	52	# Create a new .gitignore file using the Python template	COMMENT

Over-Commented Block149 hits · 147 pts

Severity	File	Line	Snippet	Context
LOW	internal/prompter/accessible_prompter_test.go	21	"golang.org/x/sys/unix"	COMMENT
LOW	internal/prompter/prompter.go	21	Select(prompt string, defaultValue string, options []string) (int, error)	COMMENT
LOW	internal/prompter/huh_prompter_test.go	41	time.Sleep(s.delay)	COMMENT
LOW	internal/prompter/prompter_mock.go	1	// Code generated by moq; DO NOT EDIT.	COMMENT
LOW	internal/prompter/prompter_mock.go	21	// panic("mock out the AuthToken method")	COMMENT
LOW	internal/prompter/prompter_mock.go	41	// MultiSelectWithSearchFunc: func(prompt string, searchPrompt string, defaults []string, persistentOptions []string,	COMMENT
LOW	internal/ghcmd/cmd.go	421	return executableName	COMMENT
LOW	internal/ghcmd/update_enabled.go	1	//go:build updateable	COMMENT
LOW	internal/gh/gh.go	81	Migrate(Migration) error	COMMENT
LOW	internal/gh/gh.go	141	// RefreshStatus describes the outcome of attempting to refresh an authentication token.	COMMENT
LOW	internal/gh/gh.go	181	//	COMMENT
LOW	internal/gh/gh.go	201	// ErrRefreshTokenInvalid is returned by a TokenRefresher when the OAuth server rejects the refresh token because it is	COMMENT
LOW	internal/gh/gh.go	221	HasActiveToken(hostname string) bool	COMMENT
LOW	internal/gh/gh.go	241		COMMENT
LOW	internal/gh/gh.go	261	// when the host has no api_host set. See config.AuthConfig.APIHostForHost.	COMMENT
LOW	internal/gh/gh.go	301	TokenForUser(hostname, user string) (credential Credential, err error)	COMMENT
LOW	internal/gh/mock/config.go	21	// mockedConfig := &ConfigMock{	COMMENT
LOW	internal/gh/mock/config.go	41	// panic("mock out the Clipboard method")	COMMENT
LOW	internal/gh/mock/config.go	61	// PagerFunc: func(hostname string) gh.ConfigEntry {	COMMENT
LOW	internal/gh/mock/config.go	81	// },	COMMENT
LOW	internal/gh/mock/token_refresher.go	21	// mockedTokenRefresher := &TokenRefresherMock{	COMMENT
LOW	internal/gh/mock/migration.go	21	// mockedMigration := &MigrationMock{	COMMENT
LOW	internal/safeurl/safeurl.go	1	// Package safeurl provides helpers for building REST API URL paths (and full	COMMENT
LOW	internal/safeurl/safeurl.go	101	}	COMMENT
LOW	internal/config/refreshable.go	21	// credential record, kept separate from the non-expiring oauth_token so that neither	COMMENT
LOW	internal/config/refreshable.go	61		COMMENT
LOW	internal/config/refreshable.go	161	// Remove any non-expiring credential for this user so a stale token cannot be resolved in preference to the	COMMENT
LOW	internal/config/refreshable.go	441	// otherwise hammer the token endpoint on every gh invocation.	COMMENT
LOW	internal/config/config.go	261	acquireRefreshLock func(ctx context.Context, path string) (unlock func(), err error)	COMMENT
LOW	internal/config/config.go	421	return "", false	COMMENT
LOW	internal/config/config.go	761		COMMENT
LOW	internal/config/test.go	121	return cfg.CacheDir()	COMMENT
LOW	internal/config/migration/multi_account.go	41	//	COMMENT
LOW	internal/config/migration/multi_account.go	61	// put that under the new user entry, otherwise there will be no value for the	COMMENT
LOW	internal/agents/detect.go	121	// Anthropic Claude Code - https://docs.anthropic.com/en/docs/agents-and-tools/claude-code/overview	COMMENT
LOW	internal/codespaces/api/api.go	1	package api	COMMENT
LOW	…/rpc/codespace/codespace_host_service.v1.proto.mock.go	21	// NotifyCodespaceOfClientActivityFunc: func(contextMoqParam context.Context, notifyCodespaceOfClientActivityRequest *	COMMENT
LOW	…paces/rpc/ssh/ssh_server_host_service.v1.proto.mock.go	21	// StartRemoteServerAsyncFunc: func(contextMoqParam context.Context, startRemoteServerRequest *StartRemoteServerReques	COMMENT
LOW	…c/jupyter/jupyter_server_host_service.v1.proto.mock.go	21	// GetRunningServerFunc: func(contextMoqParam context.Context, getRunningServerRequest GetRunningServerRequest) (Get	COMMENT
LOW	internal/featuredetection/feature_detection.go	21	SearchFeatures() (SearchFeatures, error)	COMMENT
LOW	internal/featuredetection/feature_detection.go	41	// - Mutations take logins (replaceActorsForAssignable, requestReviewsByLogin)	COMMENT
LOW	internal/featuredetection/feature_detection.go	101	}	COMMENT
LOW	internal/featuredetection/feature_detection.go	401	// Once GHES 3.17 support ends, we don't need this and, probably, the entire search feature detection.	COMMENT
LOW	internal/featuredetection/feature_detection.go	521		COMMENT
LOW	internal/telemetry/telemetry.go	421	}	COMMENT
LOW	internal/telemetry/detach_windows.go	1	//go:build windows	COMMENT
LOW	internal/attachments/references.go	21	//	COMMENT
LOW	internal/attachments/references.go	81	return attachableMarkdown{markdown: md, refs: refs, args: attachmentArgs}, nil	COMMENT
LOW	internal/attachments/references.go	141	// inside the label survive.	COMMENT
LOW	internal/attachments/attach.go	21	// Dir is the directory of the file Markdown was read from, or "" when it	COMMENT
LOW	internal/attachments/attach.go	61	return fmt.Sprintf("no document references %s", strings.Join(e.Paths, ", "))	COMMENT
LOW	internal/attachments/attach.go	101	// references resolve against its own Dir first and the working directory	COMMENT
LOW	internal/attachments/doc.go	1	// Package attachments implements the --attach flag.	COMMENT
LOW	internal/attachments/doc.go	21	// // already makes.	COMMENT
LOW	internal/attachments/doc.go	41	// be referenced by something. At zero nothing is stranded and nothing is	COMMENT
LOW	internal/barista/observability/telemetry.twirp.go	521	// that is everything in a Twirp route except for the <Method>. This can be used for routing,	COMMENT
LOW	internal/barista/observability/telemetry.twirp.go	541	}	COMMENT
LOW	internal/barista/observability/telemetry.twirp.go	901		COMMENT
LOW	docs/release-process-deep-dive.md	261	# metacharacters cannot break quoting or be injected.	COMMENT
LOW	script/refreshable-token-gitcredential-e2e.sh	1	#!/usr/bin/env bash	COMMENT
89 more matches not shown…

Decorative Section Separators43 hits · 130 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	script/refreshable-token-gitcredential-e2e.sh	91	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	script/refreshable-token-gitcredential-e2e.sh	93	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-gitcredential-e2e.sh	47	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-gitcredential-e2e.sh	49	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-gitcredential-e2e.sh	151	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-gitcredential-e2e.sh	153	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-gitcredential-e2e.sh	177	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-gitcredential-e2e.sh	179	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-gitcredential-e2e.sh	194	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-gitcredential-e2e.sh	196	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-gitcredential-e2e.sh	270	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-gitcredential-e2e.sh	272	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-gitcredential-e2e.sh	297	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-gitcredential-e2e.sh	299	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-gitcredential-e2e.sh	346	# ===========================================================================	COMMENT
MEDIUM	script/refreshable-token-gitcredential-e2e.sh	348	# ===========================================================================	COMMENT
MEDIUM	script/refreshable-token-gitcredential-e2e.sh	483	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-gitcredential-e2e.sh	485	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	script/refreshable-token-e2e.sh	70	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	script/refreshable-token-e2e.sh	72	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-e2e.sh	33	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-e2e.sh	35	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-e2e.sh	109	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-e2e.sh	111	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-e2e.sh	141	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-e2e.sh	143	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-e2e.sh	158	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-e2e.sh	160	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-e2e.sh	186	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-e2e.sh	188	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-e2e.sh	214	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-e2e.sh	216	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-e2e.sh	298	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-e2e.sh	300	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-e2e.sh	434	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-e2e.sh	436	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-e2e.sh	589	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-e2e.sh	591	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-e2e.sh	626	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	script/refreshable-token-e2e.sh	628	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/workflows/scripts/bump-go.sh	14	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	.github/workflows/scripts/spam-detection/eval.sh	94	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/workflows/scripts/spam-detection/eval.sh	98	# ---------------------------------------------------------------------------	COMMENT

Structural Annotation Overuse18 hits · 32 pts

Severity	File	Line	Snippet	Context
LOW⚡	docs/working-with-us.md	10	## Step 0: Create an extension	COMMENT
LOW⚡	docs/working-with-us.md	20	## Step 1: UX review	COMMENT
LOW⚡	docs/working-with-us.md	28	## Step 2: Public Preview	COMMENT
LOW⚡	docs/working-with-us.md	32	## Step 3: Merge or no merge	COMMENT
LOW	.github/workflows/dependabot-triage.md	182	## Step 1: Load your triage instructions	COMMENT
LOW	.github/workflows/dependabot-triage.md	190	## Step 2: Your working scope	COMMENT
LOW	.github/workflows/dependabot-triage.md	218	## Step 3: Assess each PR in the work list	COMMENT
LOW	.github/workflows/dependabot-triage.md	232	## Step 4: Post the assessment	COMMENT
LOW	.github/workflows/issue-triage.md	144	## Step 1: Load your triage instructions	COMMENT
LOW⚡	.github/workflows/issue-triage.md	158	## Step 2: Read the issue	COMMENT
LOW⚡	.github/workflows/issue-triage.md	167	## Step 3: Run duplicate detection	COMMENT
LOW⚡	.github/workflows/issue-triage.md	172	## Step 4: Classify the issue	COMMENT
LOW	.github/workflows/issue-triage.md	186	## Step 5: Check for spam	COMMENT
LOW	.github/workflows/issue-triage.md	205	## Step 6: Investigate the likely cause	COMMENT
LOW	.github/workflows/issue-triage.md	223	## Step 7: Suggest the remaining labels via safe outputs	COMMENT
LOW	.github/extensions/terminal-mockup/assets/ansi.js	47	// Step 1: parse ANSI escape codes into a flat segment list, ignoring brackets.	COMMENT
LOW	.github/extensions/terminal-mockup/assets/ansi.js	122	// Step 2: walk segments and split on bracket markup, updating per-segment classes.	COMMENT
LOW	.github/extensions/terminal-mockup/assets/ansi.js	177	// Step 3: optional auto-styling for plain-looking segments.	COMMENT

Modern AI Meta-Vocabulary11 hits · 29 pts

Severity	File	Line	Snippet	Context
MEDIUM	.github/workflows/agentics-maintenance.yml	24	# This file defines the generated agentic maintenance workflow for this repository.	COMMENT
MEDIUM	…thub/workflows/scripts/spam-detection/eval-prompts.yml	4891	input: "<TITLE>\nLocal extensions can override core commands\n</TITLE>\n\n<BODY>\n### Describe the bug\n\n1. Local e	CODE
MEDIUM	.github/agents/agentic-workflows.md	45	- Configuration: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/github-agentic-workflows.md`	CODE
MEDIUM⚡	.github/agents/agentic-workflows.md	69	Prompt file: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/create-agentic-workflow.md`	CODE
MEDIUM⚡	.github/agents/agentic-workflows.md	79	Prompt file: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/update-agentic-workflow.md`	CODE
MEDIUM⚡	.github/agents/agentic-workflows.md	89	Prompt file: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/debug-agentic-workflow.md`	CODE
MEDIUM⚡	.github/agents/agentic-workflows.md	99	Prompt file: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/upgrade-agentic-workflows.md`	CODE
MEDIUM	.github/agents/agentic-workflows.md	119	Prompt file: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/create-shared-agentic-workflow.md`	CODE
MEDIUM	.github/agents/agentic-workflows.md	193	# Initialize repository for agentic workflows	COMMENT
MEDIUM	.github/agents/agentic-workflows.md	225	- Always reference the instructions file at `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/github-agent	CODE
MEDIUM	.github/scripts/dependabot-triage.sh	106	# Only the agentic workflow consumes this output. Treat an unreadable	COMMENT

AI Slop Vocabulary7 hits · 20 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	script/refreshable-token-gitcredential-e2e.sh	92	# Capture harness	COMMENT
MEDIUM⚡	script/refreshable-token-e2e.sh	71	# Capture harness	COMMENT
MEDIUM	script/api-host-gateway/test.sh	399	# docs/api-host-test-harness.md, so it is meant to be read and diffed directly.	COMMENT
MEDIUM	…thub/workflows/scripts/spam-detection/eval-prompts.yml	3341	input: "<TITLE>\nAdd the ability to delete the \"last\" comment, similar to `--edit-last`\n</TITLE>\n\n<BODY>\n### D	CODE
MEDIUM	…thub/workflows/scripts/spam-detection/eval-prompts.yml	3341	input: "<TITLE>\nAdd the ability to delete the \"last\" comment, similar to `--edit-last`\n</TITLE>\n\n<BODY>\n### D	CODE
MEDIUM	…thub/workflows/scripts/spam-detection/eval-prompts.yml	4605	input: "<TITLE>\n`--allow-forking=false` not interpreted correctly if forking disabled at organization level\n</TITL	CODE
MEDIUM	…thub/workflows/scripts/spam-detection/eval-prompts.yml	4751	input: "<TITLE>\n`gh repo create` to work on bare repos\n</TITLE>\n\n<BODY>\n### Describe the feature or problem you	CODE

Fake / Example Data11 hits · 16 pts

Severity	File	Line	Snippet	Context
LOW	.github/workflows/shared/spam-criteria.md	58	- Generic placeholder text like "Lorem ipsum" or "test test test".	CODE
LOW	pkg/cmd/search/commits/commits.go	64	# Search commits authored by users with name "Jane Doe"	COMMENT
LOW	pkg/cmd/search/commits/commits.go	65	$ gh search commits --author-name="Jane Doe"	CODE
LOW⚡	pkg/cmd/pr/comment/comment_test.go	838	if body != "Lorem ipsum dolor sit amet, consectet lo..." {	CODE
LOW⚡	pkg/cmd/pr/comment/comment_test.go	838	if body != "Lorem ipsum dolor sit amet, consectet lo..." {	CODE
LOW⚡	pkg/cmd/pr/comment/comment_test.go	848	{ID: "id1", Author: api.CommentAuthor{Login: "octocat"}, URL: "https://github.com/OWNER/REPO/pull/123#issuecomment-1	CODE
LOW⚡	pkg/cmd/pr/comment/comment_test.go	848	{ID: "id1", Author: api.CommentAuthor{Login: "octocat"}, URL: "https://github.com/OWNER/REPO/pull/123#issuecomment-1	CODE
LOW⚡	pkg/cmd/issue/comment/comment_test.go	888	if body != "Lorem ipsum dolor sit amet, consectet lo..." {	CODE
LOW⚡	pkg/cmd/issue/comment/comment_test.go	888	if body != "Lorem ipsum dolor sit amet, consectet lo..." {	CODE
LOW⚡	pkg/cmd/issue/comment/comment_test.go	898	{ID: "id1", Author: api.CommentAuthor{Login: "octocat"}, URL: "https://github.com/OWNER/REPO/pull/123#issuecomment-1	CODE
LOW⚡	pkg/cmd/issue/comment/comment_test.go	898	{ID: "id1", Author: api.CommentAuthor{Login: "octocat"}, URL: "https://github.com/OWNER/REPO/pull/123#issuecomment-1	CODE

AI Response Leakage2 hits · 10 pts

Severity	File	Line	Snippet	Context
HIGH	pkg/cmd/agent-task/shared/testdata/log-2-input.txt	25	data: {"choices":[{"delta":{"role":"assistant","content":"Now I'll outline my plan and create the YAML file with random	CODE
HIGH	pkg/cmd/agent-task/shared/testdata/log-2-input.txt	27	data: {"id":"msg_vrtx_01NaCn7ycmvQft1NL27xNjvW","created":1757597779,"model":"claude-sonnet-4","choices":[{"finish_reaso	CODE

Verbosity Indicators5 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	.github/extensions/terminal-mockup/assets/ansi.js	47	// Step 1: parse ANSI escape codes into a flat segment list, ignoring brackets.	COMMENT
LOW	.github/extensions/terminal-mockup/assets/ansi.js	122	// Step 2: walk segments and split on bracket markup, updating per-segment classes.	COMMENT
LOW	.github/extensions/terminal-mockup/assets/ansi.js	177	// Step 3: optional auto-styling for plain-looking segments.	COMMENT
LOW	pkg/cmd/agent-task/view/view.go	183	// so we need to check if the selector arg is a reference and fetch the PR	COMMENT
LOW	pkg/cmd/issue/shared/lookup.go	37	// if there is an issue repo returned, then we need to check if it is the same as the previous one	COMMENT

Excessive Try-Catch Wrapping4 hits · 7 pts

Severity	File	Line	Snippet	Context
LOW	pkg/cmd/agent-task/shared/testdata/log-2-want.txt	225	except Exception as e:	CODE
MEDIUM	pkg/cmd/agent-task/shared/testdata/log-2-want.txt	226	print(f'Error: {e}')	CODE
MEDIUM	pkg/cmd/agent-task/shared/testdata/log-2-input.txt	41	data: {"choices":[{"delta":{"role":"assistant","content":"Let me try a different approach to verify the YAML:"},"finish_	CODE
MEDIUM	pkg/cmd/agent-task/shared/testdata/log-2-input.txt	43	data: {"id":"msg_vrtx_01GbFRhuSh5bH1VPVEAMD8L9","created":1757597820,"model":"claude-sonnet-4","choices":[{"finish_reaso	CODE

Example Usage Blocks4 hits · 5 pts

Severity	File	Line	Snippet	Context
LOW	script/refreshable-token-gitcredential-e2e.sh	29	# Usage:	COMMENT
LOW	script/refreshable-token-e2e.sh	21	# Usage:	COMMENT
LOW	.github/workflows/scripts/bump-go.sh	5	# Usage:	COMMENT
LOW	.github/workflows/scripts/spam-detection/eval.sh	18	# Usage:	COMMENT

Slop Phrases2 hits · 5 pts

Severity	File	Line	Snippet	Context
MEDIUM	…thub/workflows/scripts/spam-detection/eval-prompts.yml	4851	input: "<TITLE>\nCan't install forked extension\n</TITLE>\n\n<BODY>\n### Describe the bug\r\n\r\nI have forked an [e	CODE
MEDIUM	pkg/cmd/preview/prompter/prompter.go	177	// Here, we return a static set of options for demonstration purposes.	COMMENT

Synthetic Comment Markers1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	pkg/cmd/agent-task/shared/testdata/log-1-input.txt	61	data: {"choices":[{"delta":{"role":"assistant","content":"Excellent! The security analysis shows no vulnerabilities. \n\	CODE

cli/cli

Open-Source Code Quality, Security and Technical Debt Review