AI Slop Code Risk Monitor

hashicorp/packer

SlopCodeMonitor badge for hashicorp/packer Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

Packer is a tool for creating identical machine images for multiple platforms from a single source configuration.

1.4 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for hashicorp/packer, a Go project with 15,820 GitHub stars. SynthScan examined 93,565 lines of code across 898 source files, recording 107 pattern matches distributed across 8 syntactic categories. The legacy adjusted pattern signal is 1.4 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

1.4
Adjusted Signal
1.4
Raw Pattern Score
100%
Time Factor
2026-10-30
Last Push
15.8K
Stars
Go
Language
93.6K
Lines of Code
898
Files
107
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 6.8/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 103 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.2/100 · LOW

Are imports declared and package/API names verified? 4 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 0 finding(s).

PR Review Velocity Impact 6.1/100 · LOW

Which changes need focused human review? 107 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 5LOW 102

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 107 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block78 hits · 76 pts
SeverityFileLineSnippetContext
LOW.golangci.yml61 # include test files or not, default is trueCOMMENT
LOW.golangci.yml81 # won't be reported. Default value is empty list, but there isCOMMENT
LOW.golangci.yml121COMMENT
LOWmain.go121 // We're the child, so just close the tempfile we made in order toCOMMENT
LOWdatasource/hcp-packer-iteration/data.go61 return nilCOMMENT
LOWdatasource/hcp-packer-image/data.go41 // `hcp-packer-image`s use a shared `hcp-packer-iteration` that willCOMMENT
LOWdatasource/hcp-packer-image/data.go101 return nilCOMMENT
LOWacctest/testing.go41 // Check is called after this step is executed in order to test thatCOMMENT
LOWacctest/testing.go81type TestBuilderSet struct {COMMENT
LOWpost-processor/provenance/post-processor.go41 // The SLSA `buildType` URI recorded in the provenance predicate. Defaults toCOMMENT
LOWpost-processor/provenance/post-processor.go61 SourceURI string `mapstructure:"source_uri"`COMMENT
LOWpost-processor/provenance/post-processor.go81 // `hashivault://...` for `kms` mode.COMMENT
LOWinternal/hcp/registry/types.metadata_store.go1// Copyright IBM Corp. 2024, 2026COMMENT
LOWprovisioner/file/provisioner.go21 "github.com/hashicorp/packer-plugin-sdk/template/config"COMMENT
LOWprovisioner/file/provisioner.go41 // A list of sources to upload. This can be used in place of the `source`COMMENT
LOWprovisioner/powershell/provisioner.go81 // Defaults to false. When true any script created by a non-elevated PowershellCOMMENT
LOWprovisioner/hcp-sbom/provisioner.go41 // You can specify an absolute or a path relative to the working directoryCOMMENT
LOWprovisioner/hcp-sbom/provisioner.go61 // `["-o", "cyclonedx-json"]`.COMMENT
LOWprovisioner/hcp-sbom/provisioner.go81 // - `{{.Path}}` - Path to the scanner binary on the remote hostCOMMENT
LOWprovisioner/hcp-sbom/provisioner.go141}COMMENT
LOWprovisioner/hcp-sbom/provisioner.go161// /tmp/packer-sbom-runnerCOMMENT
LOWprovisioner/hcp-sbom/provisioner.go241COMMENT
LOWprovisioner/hcp-sbom/provisioner.go461 }COMMENT
LOWhcl2template/docs.go1// Copyright IBM Corp. 2024, 2026COMMENT
LOWhcl2template/types.packer_config.go221// unused maybe remove?COMMENT
LOWhcl2template/types.variables.go21// A consistent detail message for all "not a valid identifier" diagnostics.COMMENT
LOWhcl2template/types.variables.go61 // Values contains possible values for the variable; The last value setCOMMENT
LOWhcl2template/types.variables.go461COMMENT
LOWhcl2template/parser.go81 hcl2VarJsonFileExt = ".pkrvars.json"COMMENT
LOWhcl2template/parser.go401func (cfg *PackerConfig) buildPrereqsDAG() (*dag.AcyclicGraph, error) {COMMENT
LOWhcl2template/types.refstring.go21 // RefMType is the top-level label, that is used to know which type ofCOMMENT
LOWhcl2template/addrs/referenceable.go1// Copyright IBM Corp. 2024, 2026COMMENT
LOWhcl2template/addrs/parse_ref.go21// given traversal, which must be an absolute traversal or this functionCOMMENT
LOWhcl2template/addrs/plugin.go41 return p.SourceCOMMENT
LOWhcl2template/addrs/plugin.go61// subsequent call, in which case the result will be identical.COMMENT
LOWhcl2template/addrs/plugin.go161COMMENT
LOWhcl2template/addrs/doc.go1// Copyright IBM Corp. 2024, 2026COMMENT
LOWhcl2template/repl/repl.go1// Copyright IBM Corp. 2024, 2026COMMENT
LOWhcl2template/function/encoding.go41 },COMMENT
LOWhcl2template/function/datetime.go81 }COMMENT
LOWversion/version.go21COMMENT
LOWexamples/ci/github-actions-l2-keyless.yml1# Reference workflow — NOT wired into this repository's CI.COMMENT
LOWexamples/ci/github-actions-l2-keyless.yml41 version: latestCOMMENT
LOWexamples/ci/github-actions-l3-delegated.yml1# Reference workflow — NOT wired into this repository's CI.COMMENT
LOWexamples/hcl/linux/source.vsphere-iso.pkr.hcl1// I use the following config with direnv and set the following values:COMMENT
LOWfix/fixer.go1// Copyright IBM Corp. 2024, 2026COMMENT
LOW.github/CONTRIBUTING.md441COMMENT
LOW.github/CONTRIBUTING.md461 // test running. For example, you can use this to make sure certainCOMMENT
LOW.github/CONTRIBUTING.md481 //COMMENT
LOW.github/CONTRIBUTING.md621```goCOMMENT
LOW.github/CONTRIBUTING.md641 // is a valid entry for "template" here, but the complete Packer template:COMMENT
LOWpacker_test/common/suite.go21 pluginsDirectory stringCOMMENT
LOWpacker_test/common/plugin.go161 suite *PackerTestSuiteCOMMENT
LOWpacker_test/common/plugin.go181//COMMENT
LOWpacker_test/common/commands.go121// SetAssertFatal allows changing how Assert behaves when reporting an error.COMMENT
LOWpacker_test/common/check/pipe_checker.go181 }COMMENT
LOW…er_test/provisioner_tests/hcp-sbom/provisioner_test.go21COMMENT
LOWcommand/init_test.go61 tests := []testCaseInit{COMMENT
LOWcommand/init_test.go81 // "github.com/hashicorp/hashicups/packer-plugin-hashicups_v1.0.1_x5.0_linux_amd64_SHA256SUM": "0a4e4e1d6de280COMMENT
LOWcommand/hcl2_upgrade.go41# Avoid mixing go templating calls ( for example ` + "```{{ upper(`string`) }}```" + ` )COMMENT
18 more matches not shown…
Verbosity Indicators9 hits · 19 pts
SeverityFileLineSnippetContext
LOW⚡provisioner/hcp-sbom/provisioner.go529 // Step 1: extract the binary locally from the release zip.COMMENT
LOW⚡provisioner/hcp-sbom/provisioner.go535 // Step 2: upload binary directly to remote.COMMENT
LOW⚡provisioner/hcp-sbom/provisioner.go542 // Step 3: make it executable.COMMENT
LOW⚡provisioner/hcp-sbom/provisioner.go639 // Step 2: Upload scanner to remote.COMMENT
LOW⚡provisioner/hcp-sbom/provisioner.go647 // Step 3: Run scanner on remoteCOMMENT
LOW⚡provisioner/hcp-sbom/provisioner.go655 // Step 4: Download SBOM from remoteCOMMENT
LOW⚡provisioner/hcp-sbom/provisioner.go662 // Step 5: Process SBOM for HCP (validate, compress, store)COMMENT
LOWprovisioner/hcp-sbom/provisioner.go500 // Step 1: upload zip to remote.COMMENT
LOWprovisioner/hcp-sbom/provisioner.go619 // Step 1: Download Packer release binary on the host.COMMENT
Structural Annotation Overuse9 hits · 19 pts
SeverityFileLineSnippetContext
LOW⚡provisioner/hcp-sbom/provisioner.go529 // Step 1: extract the binary locally from the release zip.COMMENT
LOW⚡provisioner/hcp-sbom/provisioner.go535 // Step 2: upload binary directly to remote.COMMENT
LOW⚡provisioner/hcp-sbom/provisioner.go542 // Step 3: make it executable.COMMENT
LOW⚡provisioner/hcp-sbom/provisioner.go639 // Step 2: Upload scanner to remote.COMMENT
LOW⚡provisioner/hcp-sbom/provisioner.go647 // Step 3: Run scanner on remoteCOMMENT
LOW⚡provisioner/hcp-sbom/provisioner.go655 // Step 4: Download SBOM from remoteCOMMENT
LOW⚡provisioner/hcp-sbom/provisioner.go662 // Step 5: Process SBOM for HCP (validate, compress, store)COMMENT
LOWprovisioner/hcp-sbom/provisioner.go500 // Step 1: upload zip to remote.COMMENT
LOWprovisioner/hcp-sbom/provisioner.go619 // Step 1: Download Packer release binary on the host.COMMENT
Slop Phrases4 hits · 12 pts
SeverityFileLineSnippetContext
MEDIUMcommand/hcl2_upgrade.go47# views them; you can change their type later on. Read the variables typeCOMMENT
MEDIUM…d/test-fixtures/hcl2_upgrade/complete/expected.pkr.hcl26# views them; you can change their type later on. Read the variables typeCOMMENT
MEDIUM…est-fixtures/hcl2_upgrade/source-name/expected.pkr.hcl26# views them; you can change their type later on. Read the variables typeCOMMENT
MEDIUM…nd/test-fixtures/hcl2_upgrade/minimal/expected.pkr.hcl26# views them; you can change their type later on. Read the variables typeCOMMENT
Fake / Example Data4 hits · 4 pts
SeverityFileLineSnippetContext
LOW…p-packer-version/test-fixtures/hcp-setup-build.pkr.hcl7 content = "Lorem ipsum dolor sit amet"CODE
LOW…p-packer-version/test-fixtures/hcp-setup-build.pkr.hcl7 content = "Lorem ipsum dolor sit amet"CODE
LOW…packer-iteration/test-fixtures/hcp-setup-build.pkr.hcl7 content = "Lorem ipsum dolor sit amet"CODE
LOW…packer-iteration/test-fixtures/hcp-setup-build.pkr.hcl7 content = "Lorem ipsum dolor sit amet"CODE
Self-Referential Comments1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMscripts/codesign_example.sh50# Create the sign/notarize ID "SN_ID"COMMENT
AI Slop Vocabulary1 hit · 2 pts
SeverityFileLineSnippetContext
LOWscripts/build.sh36# NOTE: I'm unsure why you don't just use realpath like belowCOMMENT
Redundant / Tautological Comments1 hit · 2 pts
SeverityFileLineSnippetContext
LOW.github/workflows/nightly-release.yml32 # Set BUILD_OUTPUT_LIST to out\<project>-<version>.<fileext>\*,out\...COMMENT