3.2

Adjusted Signal

3.2

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

9.5K

Stars

TypeScript

Language

691.7K

Lines of Code

2.0K

Files

2.2K

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 13.8/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 2166 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.8/100 · LOW

Are imports declared and package/API names verified? 41 finding(s).

Agent Over-Engineering Ratio 13.5/100 · LOW

Are wrappers, guards, and repeated structures necessary? 2130 finding(s).

PR Review Velocity Impact 15.4/100 · LOW

Which changes need focused human review? 2213 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 7HIGH 5MEDIUM 9LOW 2192

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 2213 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers2124 hits · 1989 pts

Severity	File	Line	Snippet	Context
LOW	emails/plugin-inspector-findings.tsx	11	export default function PluginInspectorFindingsEmail({	CODE
LOW	emails/secret-blocked-publish.tsx	17	export default function SecretBlockedPublishEmail({	CODE
LOW	server/convexProxy.ts	122	export function isConvexProxyMethodAllowed(method: string, env: ProxyEnv) {	CODE
LOW	server/convexProxy.ts	350	function prefetchSkillExportEntries(	CODE
LOW	server/convexProxy.ts	441	function cancelPrefetchWithArchive(	CODE
LOW	server/convexProxy.ts	535	async function readBoundedArchiveManifest(response: Response) {	CODE
LOW	server/convexProxy.ts	568	function parseSkillArchiveManifest(	CODE
LOW	server/convexProxy.ts	623	function parseSkillExportArchiveManifest(	CODE
LOW	server/convexProxy.ts	683	function isSkillExportArchiveEntry(	CODE
LOW	server/convexProxy.ts	711	function isCanonicalConvexStorageUrl(url: URL, expectedStorageOrigin: string) {	CODE
LOW	server/convexProxy.ts	722	function isMergedExportManifestEntry(value: unknown) {	CODE
LOW	server/convexProxy.ts	757	export async function verifySignedArchiveManifest(	CODE
LOW	server/convexProxy.ts	776	export function resolveConvexStorageOrigin(target: string, env: ProxyEnv) {	CODE
LOW	server/skillsShMirrorClassification.ts	107	function hasReusableClassification(	CODE
LOW	server/skillsShMirrorClassification.ts	184	function replayClassificationState(	CODE
LOW	server/skillsShMirrorClassification.ts	217	export function buildSkillsShMirrorReplayRows(	CODE
LOW	server/skillsShCatalogSource.ts	89	function normalizeControlledSupplementIds(values: unknown[]) {	CODE
LOW	server/skillsShCatalogSource.ts	105	export function buildSkillsShMirrorProofSnapshotId(args: {	CODE
LOW	server/skillsShCatalogSource.ts	159	export function parseSkillsShMirrorProofSnapshotId(snapshotId: string) {	CODE
LOW	server/skillsShCatalogSource.ts	416	function normalizeUpstreamScannerStatus(value: string) {	CODE
LOW	server/skillsShCatalogSource.ts	425	export function buildSkillsShMirrorUpstreamScanners(	CODE
LOW	server/skillsShCatalogSource.ts	509	export function skillsShSourceRetryAfterSeconds(error: unknown) {	CODE
LOW	server/skillsShCatalogSource.ts	515	function isRetryableSkillsShHttpStatus(status: number) {	CODE
LOW	server/skillsShCatalogSource.ts	564	function isSkillsShIdentitySegment(value: string) {	CODE
LOW	server/skillsShCatalogSource.ts	568	function normalizeUpstreamSourceType(value: unknown) {	CODE
LOW	server/skillsShCatalogSource.ts	608	function parseExactGitHubRepositoryUrl(value: string) {	CODE
LOW	server/skillsShCatalogSource.ts	642	function repositoryIdentityFromHtml(html: string, expectedOwner: string, expectedRepo: string) {	CODE
LOW	server/skillsShCatalogSource.ts	688	function exactSkillsShIdentityPageUrl(value: string, expectedPath: string) {	CODE
LOW	server/skillsShCatalogSource.ts	738	function parseExactGitHubInstallIdentity(source: string, installUrl: string \| null) {	CODE
LOW	server/skillsShCatalogSource.ts	746	export function buildSkillsShMirrorObservation(	CODE
LOW	server/skillsShCatalogSource.ts	850	async function fetchSkillsShIdentityPage(	CODE
LOW	server/skillsShCatalogSource.ts	1001	async function resolveSkillsShMirrorObservation(	CODE
LOW	server/skillsShCatalogSource.ts	1072	function normalizedRepoRelativePath(value: string) {	CODE
LOW	server/skillsShCatalogSource.ts	1084	function githubCommitFromArchiveRedirect(value: string, owner: string, repo: string) {	CODE
LOW	server/skillsShCatalogSource.ts	1105	async function fetchGitHubRepoTreeSnapshot(	CODE
LOW	server/skillsShCatalogSource.ts	1276	export function buildSkillsShMirrorDetail(detail: SkillsShCatalogDetail, maxBytes: number) {	CODE
LOW	server/skillsShCatalogSource.ts	1422	async function fetchSkillsShCatalogPageWithBytes(	CODE
LOW	server/skillsShCatalogSource.ts	1467	export async function measureSkillsShTrendingSource(	CODE
LOW	server/skillsShCatalogSource.ts	1649	function validateSkillsShMirrorProofEvidence(value: unknown): SkillsShMirrorProofEvidence {	CODE
LOW	server/skillsShCatalogSource.ts	1705	function capturedSkillsShCatalogRows(rows: SkillsShCatalogListRow[]) {	CODE
LOW	server/skillsShCatalogSource.ts	1722	function parseSkillsShPageFieldEvidence(html: string) {	CODE
LOW	server/skillsShCatalogSource.ts	1750	function parseSkillsShRscFieldEvidence(rsc: string) {	CODE
LOW	server/skillsShCatalogSource.ts	1772	function exactSkillsShProofMetadataUrl(value: string, expectedPath: string, rsc: boolean) {	CODE
LOW	server/skillsShCatalogSource.ts	1868	export async function measureSkillsShMirrorProofSource(	CODE
LOW	server/skillsShCatalogSource.ts	2154	export async function fetchSkillsShCatalogDetail(	CODE
LOW	server/skillsShCatalogSource.ts	2172	async function fetchSkillsShMirrorDetail(id: string, options: SkillsShFetchOptions = {}) {	CODE
LOW	server/skillsShCatalogSource.ts	2346	export async function fetchSkillsShMirrorControlledBatch(	CODE
LOW	server/skillsShCatalogSource.ts	2456	export function buildSkillsShMirrorControlledObservation(	CODE
LOW	server/skillsShCatalogSource.ts	2504	export function getSkillsShCatalogTestSourcePolicy(env: SkillsShCatalogSourceEnv = process.env) {	CODE
LOW	server/skillsShCatalogSource.ts	2555	export function getSkillsShCatalogProductionSourcePolicy(	CODE
LOW	server/skillsShCatalogSource.ts	2622	export function validateSkillsShCatalogGitHubOwnerProof(	CODE
LOW	server/skillsShCatalogSource.ts	2672	async function authorizeSkillsShCatalogTestRequest(	CODE
LOW	server/skillsShCatalogSource.ts	2709	export async function fetchSkillsShCatalogTestPage(options: {	CODE
LOW	server/skillsShCatalogSource.ts	2825	function createSkillsShFetchOptions(	CODE
LOW	server/skillsShCatalogSource.ts	2837	async function selectSkillsShCatalogTestRows(	CODE
LOW	server/skillsShCatalogSource.ts	2947	export async function captureSkillsShCatalogTestSnapshot(options: {	CODE
LOW	server/og/formatOgStats.ts	33	export function resolveOgDownloadsDisplay(	CODE
LOW	server/og/fetchImageDataUrl.ts	37	export function isSafePublicHttpsOgImageUrl(url: string \| null \| undefined) {	CODE
LOW	server/og/fetchImageDataUrl.ts	91	export async function fetchPublisherProfileImageDataUrl(url: string \| null \| undefined) {	CODE
LOW	server/og/publisherOgSvg.ts	72	function normalOfficialTitleMaxWidth(contentWidth: number) {	CODE
2064 more matches not shown…

Hallucination Indicators7 hits · 70 pts

Severity	File	Line	Snippet	Context
CRITICAL	convex/maintenance.publishAttempts.test.ts	193	expect(ctx.db.get.mock.calls.filter(([id]) => id === "publishAttempts:one")).toHaveLength(1);	CODE
CRITICAL	convex/packages.public.test.ts	14669	expect(ctx.storage.store.mock.calls.some(([value]) => value.type === "application/json")).toBe(	CODE
CRITICAL	convex/publisherAbuse.test.ts	8298	expect(ctx.db.query.mock.calls.filter(([table]) => table === "skillDailyStats")).toHaveLength(	CODE
CRITICAL	convex/search.test.ts	391	ctx.db.query.mock.calls.filter(([table]) => table === "officialPublishers"),	CODE
CRITICAL	convex/search.test.ts	3848	ctx.db.query.mock.calls.filter(([table]) => table === "officialPublishers"),	CODE
CRITICAL	convex/publishAttempts.test.ts	2024	const versionPatch = ctx.db.patch.mock.calls.find(	CODE
CRITICAL	convex/featuredSelections.runtime.test.ts	224	items: ready.report.recommendations.lineup.proposed.map((item) => ({	CODE

Structural Annotation Overuse22 hits · 40 pts

Severity	File	Line	Snippet	Context
LOW	.agents/skills/controlling-costs/SKILL.md	99	### Step 1: List available notifiers	COMMENT
LOW	.agents/skills/controlling-costs/SKILL.md	108	### Step 2: Create monitors	COMMENT
LOW	.agents/skills/vercel-cli/references/integrations.md	29	# Step 1: list valid category slugs	COMMENT
LOW	.agents/skills/vercel-cli/references/integrations.md	33	# Step 2: filter discover by category	COMMENT
LOW⚡	.agents/skills/vercel-cli/command/vercel.md	9	### Step 1: Identify task type from user request	COMMENT
LOW⚡	.agents/skills/vercel-cli/command/vercel.md	13	### Step 2: Read the reference file	COMMENT
LOW⚡	.agents/skills/vercel-cli/command/vercel.md	17	### Step 3: Execute task	COMMENT
LOW	.agents/skills/vercel-cli/command/vercel.md	29	### Step 4: Summarize	COMMENT
LOW	.agents/skills/writing-evals/SKILL.md	53	### Step 1: Understand the feature	COMMENT
LOW	.agents/skills/writing-evals/SKILL.md	62	### Step 2: Determine eval type	COMMENT
LOW	.agents/skills/writing-evals/SKILL.md	75	### Step 3: Choose scorers	COMMENT
LOW	.agents/skills/writing-evals/SKILL.md	91	### Step 4: Generate	COMMENT
LOW⚡	.agents/skills/writing-evals/SKILL.md	221	### Step 1: Check for existing data	COMMENT
LOW⚡	.agents/skills/writing-evals/SKILL.md	231	### Step 2: Generate test data from code	COMMENT
LOW⚡	.agents/skills/writing-evals/SKILL.md	240	### Step 3: Cover all categories	COMMENT
LOW⚡	.agents/skills/axiom-sre/reference/query-patterns.md	10	// Step 1: Get schema with types	COMMENT
LOW⚡	.agents/skills/axiom-sre/reference/query-patterns.md	13	// Step 2: Sample raw events to see actual data shape (especially map fields)	COMMENT
LOW⚡	.agents/skills/axiom-sre/reference/query-patterns.md	16	// Step 3: Discover values of low-cardinality fields you plan to filter on	COMMENT
LOW⚡	.agents/skills/axiom-sre/reference/query-patterns.md	21	// Step 4: Discover keys inside map[string] columns (getschema won't show these)	COMMENT
LOW	.agents/skills/spl-to-apl/.meta/DESIGN-NOTES.md	43	## Step 1: Read the Schema (REQUIRED)	COMMENT
LOW	convex/skills.undeleteGate.test.ts	981	// Step 1: owner delete must be rejected by the provenance guard.	COMMENT
LOW	convex/skills.undeleteGate.test.ts	994	// Step 2: owner undelete must also be rejected, because the current	COMMENT

Fake / Example Data31 hits · 31 pts

Severity	File	Line	Snippet	Context
LOW	.agents/skills/axiom-sre/reference/blocks.md	167	"placeholder":{"type":"plain_text","text":"Choose"},	CODE
LOW	.agents/skills/axiom-sre/reference/blocks.md	180	"placeholder":{"type":"plain_text","text":"Select user"},	CODE
LOW	.agents/skills/axiom-sre/reference/blocks.md	189	"placeholder":{"type":"plain_text","text":"Select channel"},	CODE
LOW	.agents/skills/axiom-sre/reference/blocks.md	200	"placeholder":{"type":"plain_text","text":"Select date"}	CODE
LOW	convex/securityScan.test.ts	5563	vi.stubEnv("SECURITY_SCAN_WORKER_TOKEN", "placeholder");	CODE
LOW	convex/securityScan.test.ts	5568	leaseToken: "placeholder",	CODE
LOW	convex/securityScan.test.ts	5586	token: "placeholder",	CODE
LOW	convex/securityScan.test.ts	5588	leaseToken: "placeholder",	CODE
LOW	convex/securityScan.test.ts	5607	vi.stubEnv("SECURITY_SCAN_WORKER_TOKEN", "placeholder");	CODE
LOW	convex/securityScan.test.ts	5626	token: "placeholder",	CODE
LOW	convex/securityScan.test.ts	5654	vi.stubEnv("SECURITY_SCAN_WORKER_TOKEN", "placeholder");	CODE
LOW	convex/securityScan.test.ts	5677	token: "placeholder",	CODE
LOW	convex/securityScan.test.ts	5691	vi.stubEnv("SECURITY_SCAN_WORKER_TOKEN", "placeholder");	CODE
LOW	convex/securityScan.test.ts	5714	token: "placeholder",	CODE
LOW	convex/securityScan.test.ts	6703	vi.stubEnv("SECURITY_SCAN_WORKER_TOKEN", "placeholder");	CODE
LOW	convex/securityScan.test.ts	6726	token: "placeholder",	CODE
LOW	convex/securityScan.test.ts	6728	leaseToken: "placeholder",	CODE
LOW	convex/lib/skillSearchDigest.test.ts	434	ownerDisplayName: "John Doe",	CODE
LOW	convex/lib/skillSearchDigest.test.ts	445	displayName: "John Doe",	CODE
LOW	scripts/security/run-codex-scan-worker.test.ts	1296	leaseToken: "placeholder",	CODE
LOW	scripts/security/run-codex-scan-worker.test.ts	1412	leaseToken: "placeholder",	CODE
LOW	scripts/skill-cards/run-skill-card-worker.test.ts	324	displayName: "Acme Corp",	CODE
LOW	packages/clawhub-admin/src/commands/email.test.ts	61	recipient: { email: "user@example.com" },	CODE
LOW	packages/clawhub-admin/src/commands/email.test.ts	94	to: "user@example.com",	CODE
LOW	packages/clawhub-admin/src/commands/email.test.ts	104	to: "user@example.com",	CODE
LOW	packages/clawhub-admin/src/commands/email.test.ts	118	recipient: { email: "user@example.com", userId: "users:1", handle: "hansen302" },	CODE
LOW	packages/clawhub-admin/src/commands/email.test.ts	161	recipient: { email: "user@example.com", handle: "octocat" },	CODE
LOW	packages/clawhub-admin/src/commands/email.test.ts	168	to: "user@example.com",	CODE
LOW	packages/clawhub-admin/src/commands/email.test.ts	186	toEmail: "user@example.com",	CODE
LOW	src/routes/-management/ManagedMcpTools.tsx	299	? { kind: auth, header: text("header"), placeholder: text("placeholder") }	CODE
LOW	src/routes/-management/ManagedMcpTools.tsx	401	name="placeholder"	CODE

Modern AI Meta-Vocabulary7 hits · 18 pts

Severity	File	Line	Snippet	Context
MEDIUM	specs/local-moderation-fixtures.md	54	http://localhost:3000/local/local-agentic-risk-demo	CODE
MEDIUM	specs/local-moderation-fixtures.md	55	http://localhost:3000/local/local-agentic-risk-demo/security-audit	CODE
MEDIUM	.agents/skills/technical-documentation/SKILL.md	45	## Sub-agent orchestration guidance	COMMENT
MEDIUM	.agents/skills/convex-agent/SKILL.md	8	# Add an AI agent / RAG backend	COMMENT
MEDIUM	.agents/skills/writing-evals/SKILL.md	271	### eval-scaffold types	COMMENT
MEDIUM	…ents/skills/writing-evals/reference/scorer-patterns.md	91	## Pattern 4: Set Match (Retrieval / RAG)	COMMENT
MEDIUM	docs/security-audits.md	324	[OWASP Agentic Skills Top 10](https://owasp.org/www-project-agentic-skills-top-10/)	CODE

Cross-Language Confusion (JS/TS)3 hits · 15 pts

Severity	File	Line	Snippet	Context
HIGH	…pts/security/skillspector-exception-diagnostic.test.ts	35	print(json.dumps(projected))	CODE
HIGH	…pts/security/skillspector-exception-diagnostic.test.ts	101	print(json.dumps([m.project_exception(exc) for exc in cases]))	CODE
HIGH	…pts/security/skillspector-exception-diagnostic.test.ts	168	print(json.dumps({"trusted":projected,"forged":forged,"other":other,"oversize":oversize,"descriptor":descriptor}))	CODE

Empty Error Handlers2 hits · 10 pts

Severity	File	Line	Snippet	Context
HIGH	scripts/security/skillspector_exception_diagnostic.py	159	except Exception:	CODE
HIGH	scripts/security/skillspector_exception_diagnostic.py	208	except Exception:	CODE

Over-Commented Block9 hits · 5 pts

Severity	File	Line	Snippet	Context
LOW	convex/skills.ts	12241	//	COMMENT
LOW	convex/skills.ts	12261	// newer clients where the Owner selector defaulted to the caller's	COMMENT
LOW	convex/skills.ts	13261	} catch {	COMMENT
LOW	convex/skills.ts	13281	// - skill.hiddenBy === owner: the current hide was owner-initiated	COMMENT
LOW	convex/skills.ts	13301	// falling through to 500.	COMMENT
LOW	convex/skills.ts	13321	// owner simply fails this check. A security redaction / auto-ban	COMMENT
LOW	convex/skills.ts	13341	// That means a row can be `moderationStatus="active"` with a	COMMENT
LOW	convex/skills.ts	13361	if (!args.deleted && isOwner && !isModeratorOrAdmin) {	COMMENT
LOW	convex/lib/skillSlugValidator.ts	1	import { ConvexError } from "convex/values";	COMMENT

Excessive Try-Catch Wrapping4 hits · 5 pts

Severity	File	Line	Snippet	Context
LOW	scripts/security/skillspector_exception_diagnostic.py	159	except Exception:	CODE
LOW	scripts/security/skillspector_exception_diagnostic.py	199	except Exception:	CODE
LOW	scripts/security/skillspector_exception_diagnostic.py	208	except Exception:	CODE
MEDIUM	scripts/security/skillspector_exception_diagnostic.py	205	def finished():	CODE

Verbosity Indicators2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	convex/skills.undeleteGate.test.ts	981	// Step 1: owner delete must be rejected by the provenance guard.	COMMENT
LOW	convex/skills.undeleteGate.test.ts	994	// Step 2: owner undelete must also be rejected, because the current	COMMENT

Slop Phrases1 hit · 2 pts

Severity	File	Line	Snippet	Context
MEDIUM	src/components/SkillCardPreview.tsx	41	pattern: /this skill is for demonstration purposes and not for production usage\.?/iu,	CODE

Deep Nesting1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	scripts/security/skillspector_exception_diagnostic.py	109		CODE

openclaw/clawhub

Open-Source Code Quality, Security and Technical Debt Review