Home / lima-vm / lima
AI Slop Code Risk Monitor

lima-vm/lima

SlopCodeMonitor badge for lima-vm/lima Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

Linux virtual machines, with a focus on running containers

1.7 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for lima-vm/lima, a Go project with 22,212 GitHub stars. SynthScan examined 96,614 lines of code across 797 source files, recording 172 pattern matches distributed across 7 syntactic categories. The legacy adjusted pattern signal is 1.7 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

1.7
Adjusted Signal
1.7
Raw Pattern Score
100%
Time Factor
2026-10-30
Last Push
22.2K
Stars
Go
Language
96.6K
Lines of Code
797
Files
172
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 8.3/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 172 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 0 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 0 finding(s).

PR Review Velocity Impact 9.0/100 · LOW

Which changes need focused human review? 172 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 5LOW 167

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 172 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block156 hits · 137 pts
SeverityFileLineSnippetContext
LOWcmd/limactl/shell.go941//COMMENT
LOWwebsite/config.yaml1# THIS IS A TEST CONFIG ONLY!COMMENT
LOWhack/update-template-macos.sh41HELPCOMMENT
LOWhack/toolexec-for-codesign.sh1#!/bin/shCOMMENT
LOWhack/update-template-ubuntu.sh61 ["daily"]=https://cloud-images.ubuntu.com/daily/COMMENT
LOWhack/update-template-ubuntu.sh301 echo "${version}"COMMENT
LOWhack/update-template-ubuntu.sh321# ```COMMENT
LOWhack/calculate-cache.sh1#!/usr/bin/env bashCOMMENT
LOWhack/calculate-cache.sh21# 3. detect size of image, kernel, initrd, and nerdctl (responses from remote are cached for faster iteration)COMMENT
LOWhack/calculate-cache.sh61export LIMA_HOMECOMMENT
LOWhack/calculate-cache.sh141}COMMENT
LOWhack/calculate-cache.sh161# "macOS-49aa50a4872ded07ebf657c0eaf9e44ecc0c174d033a97c537ecd270f35b462f": 813179462,COMMENT
LOWhack/inject-cmdline-to-template.sh1#!/usr/bin/env bashCOMMENT
LOWhack/update-template-debian.sh221# debian_url_spec_from_location https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2COMMENT
LOWhack/update-template-debian.sh261COMMENT
LOWhack/update-template-debian.sh301COMMENT
LOWhack/cache-common-inc.sh1#!/usr/bin/env bashCOMMENT
LOWhack/cache-common-inc.sh281# image-path=.download/by-url-sha256/ae988d797c6de06b9c8a81a2b814904151135ccfd4616c22948057f6280477e8COMMENT
LOWhack/cache-common-inc.sh301# containerd-path=.download/by-url-sha256/21cc8dfa548ea8a678135bd6984c9feb9f8a01901d10b11bb491f6f4e7537158COMMENT
LOWhack/test-selinux.sh21## but it might break for other work loads if the process is running withCOMMENT
LOWhack/update-template-opensuse.sh161 [[ -n ${latest_version_info} ]] || returnCOMMENT
LOWhack/update-template.sh101# validate_url checks if the URL is valid and prints the location if it is.COMMENT
LOWhack/update-template.sh141 # - ${distribution}_cache_key_for_image_kernelCOMMENT
LOWhack/ltag/dockerfile.txt1# SPDX-FileCopyrightText: Copyright The Lima AuthorsCOMMENT
LOWhack/ltag/bash.txt1# SPDX-FileCopyrightText: Copyright The Lima AuthorsCOMMENT
LOWhack/ltag/makefile.txt1# SPDX-FileCopyrightText: Copyright The Lima AuthorsCOMMENT
LOWtemplates/k8s.yaml1# Deploy kubernetes via kubeadm.COMMENT
LOWtemplates/faasd.yaml1# Deploy faasd (which installs a bundled containerd).COMMENT
LOWtemplates/k0s.yaml1# Deploy kubernetes via k0s (which installs a bundled containerd).COMMENT
LOWtemplates/windows.yaml41# script: |COMMENT
LOWtemplates/k3s.yaml1# Deploy kubernetes via k3s (which installs a bundled containerd).COMMENT
LOWtemplates/windows-2025.yaml21 arch: "x86_64"COMMENT
LOWtemplates/windows-2025.yaml41# skipDefaultDependencyResolution: falseCOMMENT
LOWtemplates/windows-11.yaml41# script: |COMMENT
LOWtemplates/default.yaml1# ===================================================================== #COMMENT
LOWtemplates/default.yaml21# an optional `variant` (e.g. "server", "minimal", "genericcloud"), and an optional `archVariant`COMMENT
LOWtemplates/default.yaml41# CPUsCOMMENT
LOWtemplates/default.yaml61# - location: "~"COMMENT
LOWtemplates/default.yaml81# # SFTP driver, "builtin" or "openssh-sftp-server". "openssh-sftp-server" is recommended.COMMENT
LOWtemplates/default.yaml101# List of mount types not supported by the kernel of this distro.COMMENT
LOWtemplates/default.yaml121# ===================================================================== #COMMENT
LOWtemplates/default.yaml141# # 🟢 Builtin default: trueCOMMENT
LOWtemplates/default.yaml161 # If you have an insecure key under ~/.ssh, do not use this option.COMMENT
LOWtemplates/default.yaml181 # If set to `true`, this will remove all the default trusted CA certificates thatCOMMENT
LOWtemplates/default.yaml201# Upgrade the instance on bootCOMMENT
LOWtemplates/default.yaml221COMMENT
LOWtemplates/default.yaml241# - mode: userCOMMENT
LOWtemplates/default.yaml261# # `ansible` is executed after other scripts are completeCOMMENT
LOWtemplates/default.yaml281# owner: "root:root"COMMENT
LOWtemplates/default.yaml301# format: autoCOMMENT
LOWtemplates/default.yaml321# - `mode: dependency` scripts are executedCOMMENT
LOWtemplates/default.yaml341# script: |COMMENT
LOWtemplates/default.yaml361COMMENT
LOWtemplates/default.yaml381 # Full name or display name of the user.COMMENT
LOWtemplates/default.yaml401 # 🟢 Builtin default: true (false for macOS)COMMENT
LOWtemplates/default.yaml421 # Currently only applies to the primary disk image.COMMENT
LOWtemplates/default.yaml461 # Use legacy BIOS instead of UEFI. Ignored for aarch64 and vz.COMMENT
LOWtemplates/default.yaml481 # 🟢 Builtin default: ""COMMENT
LOWtemplates/default.yaml501 # As of QEMU v6.2, enabling anything but none or vnc is known to have negative impactCOMMENT
LOWtemplates/default.yaml521# # MAC address of the instance; lima will pick one based on the instance name,COMMENT
96 more matches not shown…
Redundant / Tautological Comments9 hits · 14 pts
SeverityFileLineSnippetContext
LOWhack/toolexec-for-codesign.sh32 # Check if the command is a linker command.COMMENT
LOWhack/toolexec-for-codesign.sh55# Print the output of the command and exit with the result of the command.COMMENT
LOWhack/update-template.sh204# Check if the distribution has the required functionsCOMMENT
LOWhack/bats/helpers/limactl.bash21# Close file handles 3 and 4 so the host agent doesn't block BATS from exiting.COMMENT
LOWtemplates/default.yaml700 # Set this to false for a guest that runs untrusted code, such as a CI runner.COMMENT
LOW…/cidata.TEMPLATE.d/boot.Linux/00-reboot-if-required.sh10# Check if cloud-init forgot to reboot_if_requiredCOMMENT
LOW…ata.TEMPLATE.d/boot.Linux/00-check-rtc-and-wait-ntp.sh58# Print the result of NTP synchronizationCOMMENT
LOW…/cidata/cidata.TEMPLATE.d/boot.Linux/05-lima-mounts.sh8# Check if mount type is virtiofs and vm type as vzCOMMENT
LOWpkg/limayaml/default.yaml700 # Set this to false for a guest that runs untrusted code, such as a CI runner.COMMENT
Self-Referential Comments3 hits · 9 pts
SeverityFileLineSnippetContext
MEDIUMhack/bats/helpers/limactl.bash4# Create a dummy Lima instance for testing purposes. It cannot be started because it doesn't have an actual image.COMMENT
MEDIUMpkg/driver/vz/boot.Linux/05-rosetta-volume.sh59 # Create the symlink as expected by the configuration to enable Rosetta AOT cachingCOMMENT
MEDIUMpkg/hostagent/hostagent.go294# This file is created by Lima, but not used by Lima itself currently.COMMENT
Modern AI Meta-Vocabulary1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMtemplates/README.md111#### Container orchestrationCOMMENT
Slop Phrases1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMtemplates/windows-2025.yaml12# Windows server does not require TPM by default. If you turn TPM on, you can use some security features like BitLocker COMMENT
TODO Padding1 hit · 2 pts
SeverityFileLineSnippetContext
LOWcmd/limactl/tunnel.go44 // TODO: implement l2tp, ikev2, masque, ...COMMENT
Example Usage Blocks1 hit · 2 pts
SeverityFileLineSnippetContext
LOWhack/toolexec-for-codesign.sh14# Usage:COMMENT