2.2

Adjusted Signal

2.2

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

31.1K

Stars

TypeScript

Language

240.4K

Lines of Code

1.3K

Files

402

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 7.0/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 319 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.7/100 · LOW

Are imports declared and package/API names verified? 31 finding(s).

Agent Over-Engineering Ratio 7.4/100 · LOW

Are wrappers, guards, and repeated structures necessary? 259 finding(s).

PR Review Velocity Impact 10.3/100 · LOW

Which changes need focused human review? 402 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 1MEDIUM 58LOW 343

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 402 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers207 hits · 216 pts

Severity	File	Line	Snippet	Context
LOW	setup/auto.ts	1152	async function installSelectedTemplateAgent(provider?: string): Promise<TemplateAgentOutcome> {	CODE
LOW	setup/registry-login.ts	414	function wireDockerCredentialHelper(registry?: string): void {	CODE
LOW	setup/registry-login.ts	702	export async function requestDeviceAuthorization(cfg: IdpConfig): Promise<DeviceAuthorization> {	CODE
LOW	setup/environment.ts	48	export async function detectExistingDisplayName(projectRoot: string): Promise<string \| null> {	CODE
LOW	setup/templates.ts	71	export function validateNewTemplateAgentName(	CODE
LOW	setup/install-cred-helper.ts	301	export function uninstallCredentialHelper(options: CredHelperOptions = {}): CredHelperRemovalResult {	CODE
LOW	setup/providers/install.ts	134	export function appendedHostContractModules(result: ApplyResult, projectRoot: string): string[] {	CODE
LOW	setup/providers/skill-descriptor.ts	19	export function listInstallableProviderDescriptors(projectRoot = process.cwd()): InstallableProviderDescriptor[] {	CODE
LOW	setup/providers/skill-descriptor.ts	43	export function getInstallableProviderDescriptor(	CODE
LOW	setup/gateways/selection.ts	59	export function ensureExplicitGatewaySelection(projectRoot: string, detect?: GatewayDetector): string {	CODE
LOW	setup/lib/anthropic-credential.ts	26	export function anthropicCredentialPrompt(kind: 'api' \| 'oauth'): string {	CODE
LOW	setup/lib/claude-handoff.ts	280	function claudeOfferSkippedMessage(provider: string \| undefined): string {	CODE
LOW	setup/lib/captured-token.ts	40	function normalizeCapturedTerminalOutput(raw: string): string {	CODE
LOW	setup/channels/slack-auto-register.ts	38	export function registerSlackAutoProvision(	CODE
LOW	setup/channels/run-channel-skill.ts	391	export async function runChannelSkillWithPreStep(	CODE
LOW	…ontainer/agent-runner/src/providers/opencode-config.ts	165	export function resolveOpenCodePromptModel(	CODE
LOW	…ontainer/agent-runner/src/providers/opencode-config.ts	176	export function resolveOpenCodeExecutionPolicy(): Record<string, unknown> {	CODE
LOW	…yload/container/agent-runner/src/providers/opencode.ts	205	export function setSharedRuntimeDepsForTesting(deps?: OpenCodeSharedRuntimeDeps): void {	CODE
LOW	…ontainer/agent-runner/src/providers/mcp-to-opencode.ts	23	export function mcpServersToOpenCodeConfig(	CODE
LOW	…e/skills/add-opencode/payload/scripts/opencode-host.ts	33	function supportsMaintenancePrompt(binary: string, root: string): boolean {	CODE
LOW	…e/skills/add-opencode/payload/scripts/opencode-host.ts	174	export async function offerOpenCodeFailureAssist(	CODE
LOW	…/add-opencode/payload/scripts/opencode-model-config.ts	12	export function hostAddressesForContainers(platform: NodeJS.Platform = process.platform): string[] {	CODE
LOW	…aude/skills/migrate-from-openclaw/scripts/transform.ts	282	export function approximateIntervalAsCron(everyMs: number): string \| null {	CODE
LOW	…iron-proxy/payload/src/gateway-providers/iron-proxy.ts	152	function ensureApprovalSocketAlias(settings: IronProxySettings): void {	CODE
LOW	…iron-proxy/payload/src/gateway-providers/iron-proxy.ts	259	function centralContainerStartedAt(containerName: string): Promise<number> {	CODE
LOW	…/skills/add-iron-proxy/scripts/credential-isolation.ts	18	export async function assertCredentialIsolation(	CODE
LOW	…/skills/add-iron-proxy/scripts/provider-credentials.ts	85	export function createIronCredentialConnection(	CODE
LOW	.claude/skills/add-iron-proxy/scripts/auth.ts	110	function capturedSubscriptionToken(): string {	CODE
LOW	…ntainer/agent-runner/src/providers/codex-app-server.ts	443	export function codexExecutionPolicySection(): CodexConfigPlan['executionPolicy'] {	CODE
LOW	…ntainer/agent-runner/src/providers/codex-app-server.ts	607	function removeNanoClawMemoryHooks(value: unknown, commands: ReadonlySet<string>): unknown {	CODE
LOW	…d/src/gateway-providers/onecli-provider-credentials.ts	59	export async function updateProviderCredentials(	CODE
LOW	…d/src/gateway-providers/onecli-provider-credentials.ts	103	export async function recordProviderCredentials(	CODE
LOW	…d/src/gateway-providers/onecli-provider-credentials.ts	128	export function isSavedProviderCredential(provider: string, secret: { name?: unknown }): boolean {	CODE
LOW	…d/src/gateway-providers/onecli-provider-credentials.ts	194	export function adoptSavedProviderCredentials(	CODE
LOW	…aude/skills/add-onecli/scripts/provider-credentials.ts	101	export function createOneCliCredentialConnection(	CODE
LOW	…aude/skills/add-onecli/scripts/provider-credentials.ts	227	export function createProviderCredentialConnection(	CODE
LOW	.claude/skills/add-onecli/scripts/setup.ts	176	function removeLegacyOnecliContainers(): string {	CODE
LOW	.claude/skills/add-onecli/scripts/setup.ts	215	function ensureLocalGatewayHostAccess(): void {	CODE
LOW	.claude/skills/add-onecli/scripts/auth.ts	92	function capturedSubscriptionToken(): string {	CODE
LOW	…k-agent-flow/src/modules/slack-agent-flow/provision.ts	150	export function resolveProvisioningCredential(	CODE
LOW	…agent-flow/src/modules/slack-agent-flow/orchestrate.ts	89	export async function resolveOperatorSlackUserId(sourceAgentGroupId: string): Promise<string \| null> {	CODE
LOW	…agent-flow/src/modules/slack-agent-flow/orchestrate.ts	253	async function ensurePairwiseAgentDestinations(participants: RoomParticipant[]): Promise<void> {	CODE
LOW	…-agent-flow/src/modules/slack-agent-flow/slack-deps.ts	37	export async function assertSlackInstancesModuleInstalled(): Promise<void> {	CODE
LOW	…slack-agent-flow/src/modules/slack-agent-flow/index.ts	226	async function requestSlackCreateAgentHold(content: Record<string, unknown>, session: Session): Promise<void> {	CODE
LOW	…agent-flow/src/modules/slack-agent-flow/room-canvas.ts	172	export function deriveCanvasShadowChannelId(canvasId: string): string \| undefined {	CODE
LOW	…de/skills/add-cursor/payload/setup/providers/cursor.ts	80	export async function cursorCredentialConnections(root = process.cwd()): Promise<GatewayCredentialConnection[]> {	CODE
LOW	…de/skills/add-cursor/payload/setup/providers/cursor.ts	88	export async function cursorCredentialsConnected(connections: GatewayCredentialConnection[]): Promise<boolean> {	CODE
LOW	…payload/container/agent-runner/src/providers/cursor.ts	527	export function cursorExecutionPolicySection(): CursorExecutionPolicy {	CODE
LOW	docs/SPEC.md	154	export function getRegisteredChannelNames(): string[] {	CODE
LOW	container/agent-runner/src/poll-loop.ts	319	function formatMessagesWithCommands(	CODE
LOW	container/agent-runner/src/compact-instructions.ts	41	export function buildPostCompactionReminder(names: string[], taskId: string \| null): string {	CODE
LOW	container/agent-runner/src/browser-trust.ts	20	export function trustGatewayCaForChromium(	CODE
LOW	container/agent-runner/src/destinations.ts	63	export function buildSystemPromptAddendum(assistantName?: string, mode: SessionMode = { kind: 'chat' }): string {	CODE
LOW	container/agent-runner/src/memory/session-hook.ts	21	export function memoryContextForSessionStart(source: MemorySessionStartSource, baseDir?: string): string \| undefined {	CODE
LOW	container/agent-runner/src/mailbox/model.generated.ts	247	function optionalNullableTimestamp(record: UnknownRecord, key: string): IsoTimestamp \| null \| undefined {	CODE
LOW	container/agent-runner/src/mailbox/model.generated.ts	259	function nullableNonNegativeInteger(record: UnknownRecord, key: string): number \| null {	CODE
LOW	container/agent-runner/src/mailbox/model.generated.ts	499	export function parseSessionRoutingRecord(value: unknown): SessionRoutingRecord {	CODE
LOW	container/agent-runner/src/mailbox/model.generated.ts	625	export function createDirectOutboundRecord(	CODE
LOW	container/agent-runner/src/mailbox/index.ts	18	export function resetAgentMailboxForTesting(): AgentMailboxFactory \| undefined {	CODE
LOW	container/agent-runner/src/mailbox/sqlite/operations.ts	98	export function sqliteFindQuestionResponse(questionId: string): MessageInRow \| undefined {	CODE
147 more matches not shown…

Decorative Section Separators51 hits · 152 pts

Severity	File	Line	Snippet	Context
MEDIUM	nanoclaw.sh	26	# ─── --slack-agents: former testing flag, accepted and ignored ─────────	COMMENT
MEDIUM	nanoclaw.sh	40	# ─── --help: show usage without bootstrapping ──────────────────────────	COMMENT
MEDIUM	nanoclaw.sh	56	# ─── --uninstall: short-circuit before any setup work ──────────────────	COMMENT
MEDIUM	nanoclaw.sh	107	# ─── log helpers ────────────────────────────────────────────────────────	COMMENT
MEDIUM	nanoclaw.sh	166	# ─── bash-side "clack-alike" status line ────────────────────────────────	COMMENT
MEDIUM	nanoclaw.sh	192	# ─── fresh-run setup ────────────────────────────────────────────────────	COMMENT
MEDIUM	nanoclaw.sh	207	# ─── pre-flight: minimum hardware specs ────────────────────────────────	COMMENT
MEDIUM	nanoclaw.sh	257	# ─── pre-flight: Google Cloud VM warning (Linux) ──────────────────────	COMMENT
MEDIUM	nanoclaw.sh	284	# ─── pre-flight: root user warning (Linux) ────────────────────────────	COMMENT
MEDIUM	nanoclaw.sh	317	# ─── pre-flight: Homebrew on macOS ─────────────────────────────────────	COMMENT
MEDIUM	nanoclaw.sh	365	# ─── first step: install the basics (Node + pnpm + native modules) ─────	COMMENT
MEDIUM	nanoclaw.sh	418	# ─── hand off to setup:auto ────────────────────────────────────────────	COMMENT
MEDIUM	migrate-v2.sh	111	# ─── output helpers ──────────────────────────────────────────────────────	COMMENT
MEDIUM	migrate-v2.sh	131	# ─── init logs ───────────────────────────────────────────────────────────	COMMENT
MEDIUM	migrate-v2.sh	145	# ─── phase 0a: bootstrap prerequisites ──────────────────────────────────	COMMENT
MEDIUM	migrate-v2.sh	202	# ─── phase 0b: find v1 install ──────────────────────────────────────────	COMMENT
MEDIUM	migrate-v2.sh	251	# ─── phase 0c: validate v1 DB ───────────────────────────────────────────	COMMENT
MEDIUM	migrate-v2.sh	287	# ─── run_step helper ─────────────────────────────────────────────────────	COMMENT
MEDIUM	migrate-v2.sh	334	# ─── phase 1: core state ────────────────────────────────────────────────	COMMENT
MEDIUM	migrate-v2.sh	363	# ─── phase 2: channels (interactive) ────────────────────────────────────	COMMENT
MEDIUM	migrate-v2.sh	437	# ─── phase 3: infrastructure ────────────────────────────────────────────	COMMENT
MEDIUM	migrate-v2.sh	567	# ─── service switchover ─────────────────────────────────────────────────	COMMENT
MEDIUM	migrate-v2.sh	692	# ─── phase 4: handoff ───────────────────────────────────────────────────	COMMENT
MEDIUM	migrate-v2.sh	747	# ─── hand off to Claude ─────────────────────────────────────────────────	COMMENT
MEDIUM	setup/auto.ts	865	// ─── first-chat step ───────────────────────────────────────────────────	COMMENT
MEDIUM	setup/auto.ts	987	// ─── auth step (select → branch) ────────────────────────────────────────	COMMENT
MEDIUM	setup/auto.ts	1523	// ─── timezone step ─────────────────────────────────────────────────────	COMMENT
MEDIUM	setup/auto.ts	1649	// ─── prompts owned by the sequencer ────────────────────────────────────	COMMENT
MEDIUM	setup/auto.ts	1715	// ─── interactive / env helpers ─────────────────────────────────────────	COMMENT
MEDIUM	setup/auto.ts	1747	// ─── intro + progression-log init ──────────────────────────────────────	COMMENT
MEDIUM	setup/registry.ts	107	// ─── status ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	setup/registry.ts	223	// ─── refresh ───────────────────────────────────────────────────────────	COMMENT
MEDIUM	setup/registry.ts	316	// ─── opt-out ───────────────────────────────────────────────────────────	COMMENT
MEDIUM	setup/registry.ts	347	// ─── logout ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	setup/migrate-v2/shared.ts	5	// ── JID parsing ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	setup/migrate-v2/shared.ts	98	// ── Trigger mapping ─────────────────────────────────────────────────────	COMMENT
MEDIUM	setup/migrate-v2/shared.ts	125	// ── ID generation ───────────────────────────────────────────────────────	COMMENT
MEDIUM	setup/migrate-v2/shared.ts	131	// ── Channel auth registry ───────────────────────────────────────────────	COMMENT
MEDIUM	setup/lib/setup-config.ts	172	// ─── name derivation ───────────────────────────────────────────────────	COMMENT
MEDIUM	setup/lib/registry-state.ts	339	// ─── account state ─────────────────────────────────────────────────────	COMMENT
MEDIUM	…aude/skills/add-codex/payload/setup/providers/codex.ts	22	// ─── auth step ───────────────────────────────────────────────────────────	COMMENT
MEDIUM	…aude/skills/add-codex/payload/setup/providers/codex.ts	229	// ─── failure assist ──────────────────────────────────────────────────────	COMMENT
MEDIUM	…aude/skills/add-codex/payload/setup/providers/codex.ts	326	// ─── install verification ────────────────────────────────────────────────	COMMENT
MEDIUM	…payload/container/agent-runner/src/providers/cursor.ts	102	// ─── HTTP/2 proxy-bypass guard ──────────────────────────────────────────	COMMENT
MEDIUM	…payload/container/agent-runner/src/providers/cursor.ts	509	// ─── configuration sections ─────────────────────────────────────────────	COMMENT
MEDIUM	…payload/container/agent-runner/src/providers/cursor.ts	602	// ─── stream helpers ─────────────────────────────────────────────────────	COMMENT
MEDIUM	…payload/container/agent-runner/src/providers/cursor.ts	647	// ─── hooks.json ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	…gent-runner/src/providers/cursor.gateway-proxy.test.ts	376	// ─── the guard on its own ───────────────────────────────────────────────	COMMENT
MEDIUM	docs/ollama.md	15	│ http://host.docker. │ ┌──────────────────┐	CODE
MEDIUM	src/host-sweep.test.ts	213	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/host-sweep.test.ts	224	// ─────────────────────────────────────────────────────────────────────────────	COMMENT

Over-Commented Block97 hits · 97 pts

Severity	File	Line	Snippet	Context
LOW	setup.sh	1	#!/bin/bash	COMMENT
LOW	nanoclaw.sh	1	#!/usr/bin/env bash	COMMENT
LOW	migrate-v2.sh	1	#!/usr/bin/env bash	COMMENT
LOW	migrate-v2-reset.sh	1	#!/usr/bin/env bash	COMMENT
LOW	setup/auto.ts	361	);	COMMENT
LOW	setup/registry-login.ts	381	REGISTRY_AUTH_FILE,	COMMENT
LOW	setup/verify.ts	201	//	COMMENT
LOW	setup/install-signal-cli.sh	1	#!/usr/bin/env bash	COMMENT
LOW	setup/install-claude.sh	1	#!/usr/bin/env bash	COMMENT
LOW	setup/registry-login.sh	1	#!/usr/bin/env bash	COMMENT
LOW	setup/registry-login.sh	21	# NANOCLAW_WORKOS_CLIENT_ID Device-flow client id (public, not a secret)	COMMENT
LOW	setup/container.ts	361	// owned through a mount — the old `--entrypoint /bin/echo` test ran as the	COMMENT
LOW	setup/register.ts	301	prompt: `A new ${parsed.channel} channel has been connected. Run /welcome to introduce yourself to the user.`,	COMMENT
LOW	setup/providers/index.ts	1	// Setup-side provider barrel. Provider payloads with their own setup surface	COMMENT
LOW	setup/lib/install-slug.sh	1	# install-slug.sh — shell mirror of setup/lib/install-slug.ts.	COMMENT
LOW	setup/lib/skill-driver.ts	101	// The `?` help-escape is only meaningful at a real terminal: it hands the	COMMENT
LOW	setup/lib/channels-remote.sh	1	# channels-remote.sh — resolve the git remote that carries the `channels`	COMMENT
LOW	setup/lib/diagnostics.sh	1	# diagnostics.sh — shared PostHog emitter for bash-side setup code.	COMMENT
LOW	setup/channels/imessage-configure.sh	1	#!/usr/bin/env bash	COMMENT
LOW	setup/channels/telegram-flow.test.ts	1	// The add-another-bot path, asserted against the add-telegram SKILL.md itself.	COMMENT
LOW	setup/channels/run-channel-skill.test.ts	421	});	COMMENT
LOW	…yload/container/agent-runner/src/providers/opencode.ts	241	// Owns the SSE subscription and its retry loop. Teardown closes the	COMMENT
LOW	.claude/skills/add-iron-proxy/scripts/install-claude.sh	1	#!/usr/bin/env bash	COMMENT
LOW	…ner/agent-runner/src/providers/codex-cli-tools.test.ts	1	// Structural guard for the Codex CLI install in container/cli-tools.json.	COMMENT
LOW	…dd-codex/payload/src/providers/codex-agents-md.test.ts	121	// The persona rules (leads the document, never evicted, absent without a	COMMENT
LOW	.claude/skills/add-codex/payload/src/providers/codex.ts	61	// shared provider-agnostic helper. Real dirs survive the symlink-only prune	COMMENT
LOW	.claude/skills/add-clidash/add/tools/clidash/docs.js	1	// Read-only file viewer for clidash.	COMMENT
LOW	.claude/skills/add-onecli/scripts/dial-key-check.sh	1	#!/bin/sh	COMMENT
LOW	…ude/skills/add-onecli/scripts/register-claude-token.sh	1	#!/usr/bin/env bash	COMMENT
LOW	.claude/skills/add-onecli/scripts/install-claude.sh	1	#!/usr/bin/env bash	COMMENT
LOW	…k-agent-flow/src/modules/slack-agent-flow/provision.ts	221	const AVATAR_WAIT_MS = 75_000;	COMMENT
LOW	…ontainer/agent-runner/src/provider-contracts/cursor.ts	21	// provider's own hooks.json write must stand down — otherwise both files	COMMENT
LOW	…ls/add-cursor/payload/src/provider-contracts/cursor.ts	61	location: { kind: 'state-volume', volumeId: 'cursor-home', subdirectory: '' },	COMMENT
LOW	container/release-image.sh	1	#!/bin/bash	COMMENT
LOW	container/build.sh	1	#!/bin/bash	COMMENT
LOW	container/build.sh	21	# Derive the image name from the project root so two NanoClaw installs on the	COMMENT
LOW	container/build.sh	61	CONTAINER_RUNTIME="${CONTAINER_RUNTIME:-docker}"	COMMENT
LOW	container/pull.sh	1	#!/bin/bash	COMMENT
LOW	container/pull.sh	21	#	COMMENT
LOW	container/pull.sh	201	# less than five minutes ago — so the credential is only obtainable for the	COMMENT
LOW	container/pull.sh	261	#	COMMENT
LOW	container/install-cli-tools.sh	1	#!/bin/sh	COMMENT
LOW	container/entrypoint.sh	1	#!/bin/bash	COMMENT
LOW	container/agent-runner/src/poll-loop.ts	381	// nudge — mirrors unwrappedNudged for chat turns.	COMMENT
LOW	container/agent-runner/src/poll-loop.ts	401	// user-visible go out this turn?" — which must also see MCP send_message	COMMENT
LOW	container/agent-runner/src/poll-loop.ts	481	// the canonical command path + formatMessagesWithCommands. Abort,	COMMENT
LOW	…er/agent-runner/src/poll-loop.midturn-recovery.test.ts	1	import { describe, it, expect, beforeEach, afterEach } from 'bun:test';	COMMENT
LOW	…/agent-runner/src/poll-loop.midturn-resultdoor.test.ts	1	import { describe, it, expect, beforeEach, afterEach } from 'bun:test';	COMMENT
LOW	container/agent-runner/src/providers/claude-config.ts	21	// the question and blocks on the real reply.	COMMENT
LOW	container/agent-runner/src/providers/claude.ts	341	// invisible to the poll-loop and silently lost.	COMMENT
LOW	container/agent-runner/src/providers/claude.ts	381	error: m.errors?.length ? m.errors.join('\n') : resultAsError \|\| undefined,	COMMENT
LOW	container/agent-runner/src/mcp-tools/interactive.ts	61	// renders as a dead link, and an agent asked for an approval card reaches	COMMENT
LOW	container/agent-runner/src/provider-contracts/index.ts	1	// Provider runtime-contract barrel.	COMMENT
LOW	scripts/skill-inputs.ts	1	// inputsFromEnv — the pipeline consumer's input path (docs/skill-engine-seam.md §6).	COMMENT
LOW	scripts/skill-apply.ts	1	// The skill application engine — executes `nc:` directives parsed from a SKILL.md.	COMMENT
LOW	scripts/skill-apply.ts	41	normalize?: 'trim' \| 'rstrip-slash' \| 'lower'; // applied by the ENGINE at bind	COMMENT
LOW	scripts/skill-apply.ts	281	// Non-secret resolved values (prompt answers + `run capture:<var>` outputs) so	COMMENT
LOW	scripts/skill-apply.ts	301	// runs through with no human interaction (fully programmatic apply).	COMMENT
LOW	scripts/skill-apply.ts	321	// Override dependency commands when the declared package manager is not	COMMENT
LOW	scripts/skill-apply.ts	621	// to its dot-path, so ONE API call resolves	COMMENT
37 more matches not shown…

Fake / Example Data29 hits · 30 pts

Severity	File	Line	Snippet	Context
LOW	setup/channels/run-channel-skill.test.ts	110	await runChannelSkill('teams', 'Acme Corp', {	CODE
LOW	…/add-opencode/payload/scripts/opencode-model-config.ts	151	const config = { enabled_providers: [provider], provider: { [provider]: { options: { apiKey: 'placeholder' } } } };	CODE
LOW	…ude/skills/add-iron-proxy/front-proxy/security_test.go	149	r.Header.Set("Authorization", "placeholder")	CODE
LOW	…ude/skills/add-iron-proxy/front-proxy/security_test.go	164	if headers.Get("Authorization") != "placeholder" {	CODE
LOW	…ills/add-clidash/add/tools/clidash/test/server.test.js	181	writeFileSync(join(viewsDir, '..', 'placeholder'), ''); // ensure tmp exists	CODE
LOW	…iner/agent-runner/src/providers/cursor.factory.test.ts	474	first: { type: 'stdio', command: 'bun', args: ['one.ts'], env: { TOKEN: 'placeholder' } },	CODE
LOW	…iner/agent-runner/src/providers/cursor.factory.test.ts	496	first: { command: 'bun', args: ['one.ts'], env: { TOKEN: 'placeholder' } },	CODE
LOW	…ntainer/agent-runner/src/providers/cursor-auth.test.ts	33	email: 'user@example.com',	CODE
LOW	…ntainer/agent-runner/src/providers/cursor-auth.test.ts	45	expect(result).toEqual({ email: 'user@example.com', apiKeyExpiresAtMs: 123 });	CODE
LOW	…ntainer/agent-runner/src/providers/cursor-auth.test.ts	110	email: 'user@example.com',	CODE
LOW	docs/templates.md	258	the literal `"placeholder"` always passes; a credential-shaped key with an	CODE
LOW⚡	docs/templates.md	396	config, put the literal `"placeholder"` there to satisfy the boot check:	CODE
LOW⚡	docs/templates.md	406	"env": { "ACME_API_KEY": "placeholder" }	CODE
LOW⚡	docs/templates.md	414	rejects values that match known credential formats, and `"placeholder"` is the	CODE
LOW	container/skills/agent-browser/SKILL.md	179	agent-browser fill @e1 "user@example.com"	CODE
LOW	container/agent-runner/src/plugin-mcp.test.ts	51	const http = { type: 'http' as const, url: 'https://mcp.example.com/mcp', headers: { A: 'placeholder' } };	CODE
LOW	scripts/skill-inputs.test.ts	41	NC_INPUT_BOT_TOKEN: 'xoxb-fake-token',	CODE
LOW	scripts/skill-inputs.test.ts	47	bot_token: 'xoxb-fake-token',	CODE
LOW	templates/README.md	61	to boot without an env var, use the literal `"placeholder"` — stamping	CODE
LOW	src/container-runner.test.ts	166	contribution: { env: { XDG_DATA_HOME: '/workspace/xdg', ANTHROPIC_AUTH_TOKEN: 'placeholder' } },	CODE
LOW	src/container-runner.test.ts	170	ANTHROPIC_AUTH_TOKEN: 'placeholder',	CODE
LOW	src/drivers/conformance.test.ts	475	spec.containers[0].contributedEnv = { ANTHROPIC_AUTH_TOKEN: 'placeholder' };	CODE
LOW	src/drivers/conformance.test.ts	478	expect(agent.env.ANTHROPIC_AUTH_TOKEN).toBe('placeholder');	CODE
LOW	src/drivers/conformance.test.ts	501	spec.containers[0].env.SERVICE_TOKEN = 'placeholder';	CODE
LOW	src/templates/parse.test.ts	51	env: { PRIVATE_APP_ACCESS_TOKEN: 'placeholder' },	CODE
LOW	src/templates/parse.test.ts	68	env: { PRIVATE_APP_ACCESS_TOKEN: 'placeholder' },	CODE
LOW	src/templates/parse.test.ts	279	api: { type: 'streamable-http', url: 'https://mcp.example.com/mcp', headers: { Authorization: 'placeholder' } },	CODE
LOW	src/templates/parse.test.ts	288	headers: { Authorization: 'placeholder' },	CODE
LOW	src/templates/mcp.ts	19	export const PLACEHOLDER_VALUE = 'placeholder';	CODE

Modern AI Meta-Vocabulary5 hits · 15 pts

Severity	File	Line	Snippet	Context
MEDIUM	…-flow/src/modules/slack-agent-flow/orchestrate.test.ts	336	// Upstream leg: group + scaffold + bidirectional a2a destinations.	COMMENT
MEDIUM	src/group-init.ts	35	// brand-new group that resolves to the instance default, so the scaffold and	COMMENT
MEDIUM	src/templates/restamp.test.ts	222	// plugin-data scaffold must heal without a plugin-file diff.	COMMENT
MEDIUM	src/templates/restamp.ts	143	// cwd dirs are plugin-data scaffold, not plugin files: create them even	COMMENT
MEDIUM	src/modules/agent-to-agent/create-agent.ts	280	// Passing the provider pins the child's scaffold and stamps its config row in one step.	COMMENT

Structural Annotation Overuse6 hits · 11 pts

Severity	File	Line	Snippet	Context
LOW⚡	.claude/skills/add-karpathy-llm-wiki/SKILL.md	12	## Step 1: Read the pattern	COMMENT
LOW⚡	.claude/skills/add-karpathy-llm-wiki/SKILL.md	16	## Step 2: Choose a group	COMMENT
LOW⚡	.claude/skills/add-karpathy-llm-wiki/SKILL.md	26	## Step 3: Design collaboratively	COMMENT
LOW	.claude/skills/add-karpathy-llm-wiki/SKILL.md	64	## Step 4: Source handling capabilities	COMMENT
LOW	.claude/skills/add-karpathy-llm-wiki/SKILL.md	79	## Step 5: Optional lint schedule	COMMENT
LOW	.claude/skills/add-karpathy-llm-wiki/SKILL.md	89	## Step 6: Restart	COMMENT

AI Slop Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	setup/signal-auth.ts	194	// rather than scraping stdout — more robust across signal-cli versions.	COMMENT

Redundant / Tautological Comments2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	migrate-v2.sh	608	# Check if v1 service is running	COMMENT
LOW	scripts/add-vercel-onecli.test.ts	324	['the existing-credential check', '### Check if Vercel credential already exists', 0],	CODE

Cross-Language Confusion1 hit · 2 pts

Severity	File	Line	Snippet	Context
HIGH	repo-tokens/recount.py	8	pip install tiktoken && python3 repo-tokens/recount.py	STRING

Self-Referential Comments1 hit · 2 pts

Severity	File	Line	Snippet	Context
MEDIUM	scripts/skill-apply.test.ts	1097	'## Create the bot',	CODE

Unused Imports1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	gateway-compat/onecli-summary/prepare.py	2		CODE

Excessive Try-Catch Wrapping1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	repo-tokens/action.yml	92	except Exception as e:	CODE

nanocoai/nanoclaw

Open-Source Code Quality, Security and Technical Debt Review