AI Slop Code Risk Monitor

openwrt/luci

SlopCodeMonitor badge for openwrt/luci Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

LuCI - OpenWrt Configuration Interface

0.6 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for openwrt/luci, a JavaScript project with 7,944 GitHub stars. SynthScan examined 254,597 lines of code across 1125 source files, recording 137 pattern matches distributed across 5 syntactic categories. The legacy adjusted pattern signal is 0.6 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

0.6
Adjusted Signal
0.6
Raw Pattern Score
100%
Time Factor
2026-10-31
Last Push
7.9K
Stars
JavaScript
Language
254.6K
Lines of Code
1.1K
Files
137
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 1.2/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 59 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.6/100 · LOW

Are imports declared and package/API names verified? 74 finding(s).

Agent Over-Engineering Ratio 0.7/100 · LOW

Are wrappers, guards, and repeated structures necessary? 26 finding(s).

PR Review Velocity Impact 2.9/100 · LOW

Which changes need focused human review? 137 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 5LOW 132

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 137 distinct pattern matches across 5 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Fake / Example Data74 hits · 80 pts
SeverityFileLineSnippetContext
LOW…tdocs/luci-static/resources/view/keepalived/globals.js36 o.placeholder = 'admin@example.com';CODE
LOW…tdocs/luci-static/resources/view/keepalived/globals.js41 o.placeholder = 'admin@example.com';CODE
LOW…osify/htdocs/luci-static/resources/view/qosify/main.js763 function txt(name,val,ph){return E('input',{'type':'text','class':'cbi-input-text','id':'q-'+name,'data-q':name,'valueCODE
LOW…osify/htdocs/luci-static/resources/view/qosify/main.js1043 [_('section name'),E('input',{'type':'text','class':'cbi-input-text','id':'qac-'+p.id.slice(9)+'-name','placeholder'CODE
LOW…osify/htdocs/luci-static/resources/view/qosify/main.js1138 'value':pre==='list'?ph:'','placeholder':pre==='list'?'':phCODE
LOW…osify/htdocs/luci-static/resources/view/qosify/main.js1147 this.qaCell(parent,opt,E('input',{'id':this.qaId(parent,opt),'class':'cbi-input-text','data-opt':opt,'type':'number','CODE
LOW…osify/htdocs/luci-static/resources/view/qosify/main.js1251 var qr=[['match',5,qarType],['',8,E('input',{'type':'text','class':'cbi-input-text','id':'qar-val','aria-label':_('valCODE
LOW…osify/htdocs/luci-static/resources/view/qosify/main.js1283 ['',8,E('input',{'type':'text','class':'cbi-input-text','id':'qdy-val','aria-label':_('value'),'placeholder':_('e.g. CODE
LOW…osify/htdocs/luci-static/resources/view/qosify/main.js1286 ['timeout',4,E('input',{'type':'number','min':'1','class':'cbi-input-text','id':'qdy-tmo','aria-label':'timeout','plaCODE
LOW…htdocs/luci-static/resources/view/dockerman/volumes.js126 'placeholder': _('volume name'),CODE
LOW…htdocs/luci-static/resources/view/dockerman/volumes.js137 'placeholder': 'key=value, key2=value2, ...',CODE
LOW…/luci-static/resources/view/dockerman/container_new.js397 'placeholder': _('Enter volume name or pick existing'),CODE
LOW⚡…/luci-static/resources/view/dockerman/container_new.js426 'placeholder': '128m',CODE
LOW⚡…/luci-static/resources/view/dockerman/container_new.js433 'placeholder': 'rwxr-xr-x or 1770',CODE
LOW⚡…/luci-static/resources/view/dockerman/container_new.js441 'placeholder': 'nr_blocks=blocks,...',CODE
LOW…/luci-static/resources/view/dockerman/container_new.js457 'placeholder': _('/path/in/image'),CODE
LOW…/luci-static/resources/view/dockerman/container_new.js505 'placeholder': _('/mnt/path'),CODE
LOW…docs/luci-static/resources/view/dockerman/container.js875 'placeholder': '-ww',CODE
LOW…docs/luci-static/resources/view/dockerman/container.js1032 'placeholder': 'e.g., root or user id',CODE
LOW…docs/luci-static/resources/view/dockerman/container.js1135 'placeholder': _('Type command here... (Ctrl+D to detach)'),CODE
LOW⚡…docs/luci-static/resources/view/dockerman/container.js1897 'placeholder': 'e.g., 172.18.0.5',CODE
LOW⚡…docs/luci-static/resources/view/dockerman/container.js1905 'placeholder': 'e.g., 2001:db8:1::1',CODE
LOW⚡…docs/luci-static/resources/view/dockerman/container.js1913 'placeholder': 'e.g., database,db (comma-separated)',CODE
LOW…/htdocs/luci-static/resources/view/dockerman/images.js630 'placeholder': '[registry.io[:443]/]myrepo/myimage'CODE
LOW…/htdocs/luci-static/resources/view/dockerman/images.js640 'placeholder': 'latest',CODE
LOW…nd/htdocs/luci-static/resources/view/unbound/status.js94 'placeholder': _('Statistics'),CODE
LOW…nd/htdocs/luci-static/resources/view/unbound/status.js106 'placeholder': _('Local Data'),CODE
LOW…nd/htdocs/luci-static/resources/view/unbound/status.js118 'placeholder': _('Local Zones'),CODE
LOW…nd/htdocs/luci-static/resources/view/unbound/status.js130 'placeholder': _('DNS Cache'),CODE
LOW…nd/htdocs/luci-static/resources/view/unbound/status.js141 'placeholder': _('Log'),CODE
LOW⚡…docs/luci-static/resources/view/travelmate/overview.js81 E('input', { 'class': 'cbi-input-text', 'id': 'iface', 'placeholder': 'trm_wwan', 'value': ifaceValue, 'maxlength':CODE
LOW⚡…docs/luci-static/resources/view/travelmate/overview.js85 E('input', { 'class': 'cbi-input-text', 'id': 'zone', 'placeholder': 'wan', 'maxlength': '15', 'spellcheck': 'falseCODE
LOW⚡…docs/luci-static/resources/view/travelmate/overview.js89 E('input', { 'class': 'cbi-input-text', 'id': 'metric', 'placeholder': '100', 'maxlength': '3', 'spellcheck': 'falsCODE
LOW…t/htdocs/luci-static/resources/view/weechat/servers.js127 'placeholder': '#openwrt',CODE
LOW…t/htdocs/luci-static/resources/view/weechat/servers.js146 'placeholder': _('Optional key'),CODE
LOW…hat/htdocs/luci-static/resources/view/weechat/relay.js255 'placeholder': 'router.local'CODE
LOW…hat/htdocs/luci-static/resources/view/weechat/relay.js269 'placeholder': 'router.local, 192.168.1.1'CODE
LOW…htdocs/luci-static/resources/view/adblock/dnsreport.js129 'placeholder': 'google.com',CODE
LOW…htdocs/luci-static/resources/view/adblock/dnsreport.js583 'placeholder': _('Filter'),CODE
LOW…s/luci-static/resources/view/strongswan-swanctl/log.js72 'placeholder': _('Filter')CODE
LOW…mple/htdocs/luci-static/resources/view/example/form.js44 o.placeholder = 'placeholder';CODE
LOW…tdocs/luci-static/resources/view/system/filemanager.js1358 'placeholder': _('Directory Name'),CODE
LOW…tdocs/luci-static/resources/view/system/filemanager.js1415 'placeholder': _('File Name'),CODE
LOW⚡…tdocs/luci-static/resources/view/system/filemanager.js2301 'placeholder': fileInfo.name,CODE
LOW⚡…tdocs/luci-static/resources/view/system/filemanager.js2306 'placeholder': fileInfo.numericPermissions,CODE
LOW⚡…tdocs/luci-static/resources/view/system/filemanager.js2311 'placeholder': fileInfo?.user || fileInfo.uid,CODE
LOW⚡…tdocs/luci-static/resources/view/system/filemanager.js2316 'placeholder': fileInfo?.group || fileInfo.gid,CODE
LOW…p/htdocs/luci-static/resources/view/banip/setreport.js18 'placeholder': '192.168.0.1',CODE
LOW…r/htdocs/luci-static/resources/view/package-manager.js1259 E('input', { 'type': 'text', 'name': 'filter', 'placeholder': _('Type to filter…'), 'value': query, 'input': handlCODE
LOW…r/htdocs/luci-static/resources/view/package-manager.js1267 E('input', { 'type': 'text', 'name': 'install', 'placeholder': _('Package name or URL…'), 'keydown': function(ev) CODE
LOW…em/htdocs/luci-static/resources/view/system/sshkeys.js266 'placeholder': _('Paste or drag SSH key file…') ,CODE
LOW…docs/luci-static/resources/view/network/switch-vlan.js291 'placeholder': _('label'),CODE
LOW…docs/luci-static/resources/view/network/switch-vlan.js468 'placeholder': _('label'),CODE
LOW…docs/luci-static/resources/view/network/switch-vlan.js544 'placeholder': _('VLAN'),CODE
LOW…docs/luci-static/resources/view/network/switch-vlan.js553 'placeholder': _('label (optional)'),CODE
LOWmodules/luci-base/htdocs/luci-static/resources/ui.js126 node.setAttribute('placeholder', value);CODE
LOWmodules/luci-base/htdocs/luci-static/resources/ui.js128 node.removeAttribute('placeholder');CODE
LOWmodules/luci-base/htdocs/luci-static/resources/ui.js418 'placeholder': this.options.placeholder,CODE
LOWmodules/luci-base/htdocs/luci-static/resources/ui.js564 'placeholder': this.options.placeholder,CODE
LOWmodules/luci-base/htdocs/luci-static/resources/ui.js1163 'placeholder': this.options.custom_placeholder ?? this.options.placeholder,CODE
14 more matches not shown…
Over-Commented Block36 hits · 36 pts
SeverityFileLineSnippetContext
LOWlibs/luci-lib-jsonc/src/jsonc.c241out:COMMENT
LOWlibs/rpcd-mod-luci/src/luci.c21#include <stdio.h>COMMENT
LOWlibs/rpcd-mod-luci/src/luci.c41#include <netlink/socket.h>COMMENT
LOWlibs/luci-lib-ip/src/ip.c21#include <stdbool.h>COMMENT
LOWlibs/rpcd-mod-rrdns/src/rrdns.c21#include <errno.h>COMMENT
LOWlibs/luci-lib-nixio/src/splice.c21#endifCOMMENT
LOWlibs/luci-lib-nixio/src/user.c21#include <errno.h>COMMENT
LOWlibs/luci-lib-nixio/src/sockopt.c21#ifndef __WINNT__COMMENT
LOWlibs/luci-lib-nixio/src/nixio-tls.h1#ifndef NIXIO_TLS_H_COMMENT
LOWlibs/luci-lib-nixio/src/nixio.h1#ifndef NIXIO_H_COMMENT
LOWlibs/luci-lib-nixio/src/nixio.h41 int prefix;COMMENT
LOWlibs/luci-lib-nixio/src/nixio.h61#define NIXIO_API externCOMMENT
LOWlibs/luci-lib-nixio/src/mingw-compat.h1#ifndef NIXIO_MINGW_COMPAT_H_COMMENT
LOWlibs/luci-lib-nixio/src/mingw-compat.h21COMMENT
LOW.github/workflows/codeql.yml21 # - '**/*.md'COMMENT
LOW.github/workflows/codeql.yml61 uses: github/codeql-action/init@v4COMMENT
LOW.github/workflows/codeql.yml81 # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).COMMENT
LOW.github/codeql/codeql-config.yml1name: "CodeQL config"COMMENT
LOW.github/codeql/codeql-config.yml21COMMENT
LOW…/htdocs/luci-static/resources/view/dockerman/events.js281COMMENT
LOW…htdocs/luci-static/resources/view/dockerman/volumes.js81 } catch {COMMENT
LOW…tdocs/luci-static/resources/view/dockerman/networks.js81 const output = JSON.stringify(msg, null, 2) + '\n';COMMENT
LOW…docs/luci-static/resources/view/dockerman/container.js101COMMENT
LOW…plications/luci-app-advanced-reboot/tests/run_tests.sh1#!/usr/bin/env bashCOMMENT
LOW…uci-static/resources/view/wifischedule/wifischedule.js1// Copyright (c) 2016, prpl FoundationCOMMENT
LOW…mav/htdocs/luci-static/resources/view/clamav/clamav.js321 */COMMENT
LOWmodules/luci-base/src/contrib/lemon.c1/*COMMENT
LOWmodules/luci-base/src/contrib/lemon.c21COMMENT
LOWmodules/luci-base/src/lib/luci.c21#include <pwd.h>COMMENT
LOWmodules/luci-base/src/lib/lmo.h21COMMENT
LOWmodules/luci-lua-runtime/src/template_parser.h21COMMENT
LOWmodules/luci-lua-runtime/src/template_lmo.h21COMMENT
LOWmodules/luci-lua-runtime/src/contrib/lemon.c1/*COMMENT
LOWmodules/luci-lua-runtime/src/contrib/lemon.c21COMMENT
LOWmodules/luci-mod-status/src/luci-bwc.c21#include <stdlib.h>COMMENT
LOW…eme-footstrap/htdocs/luci-static/footstrap/cascade.css1001#packages:not(.fs-stacked) .tr>.td:first-child{white-space:nowrap}COMMENT
Hyper-Verbose Identifiers22 hits · 22 pts
SeverityFileLineSnippetContext
LOWlibs/luci-lib-uqr/htdocs/luci-static/resources/uqr.js7var QrCodeDataType=(t=>(t[t.Border=-1]="Border",t[t.Data=0]="Data",t[t.Function=1]="Function",t[t.Position=2]="Position"CODE
LOW…app-chrony/htdocs/luci-static/resources/view/chrony.js166function insertTypedSectionOptions(m, s, o, type, features) {CODE
LOW…ockerman/htdocs/luci-static/resources/dockerman/api.js262function createWebSocketConnection(host, path, query) {CODE
LOW…tdocs/luci-static/resources/view/dockerman/overview.js19function getImagesInUseByContainers(containers) {CODE
LOW…tdocs/luci-static/resources/view/dockerman/overview.js33function getNetworksInUseByContainers(containers) {CODE
LOW…tdocs/luci-static/resources/view/dockerman/overview.js53function getVolumesInUseByContainers(containers) {CODE
LOW…-dawn/htdocs/luci-static/resources/dawn/dawn-common.js74function getDawnServiceNotRunningErrorMessage() {CODE
LOW…s/luci-static/resources/view/olsr-services/services.js33function extractServiceInformation(results) {CODE
LOW…ldpd/htdocs/luci-static/resources/view/lldpd/config.js130 function getLocationValueFromConfString(_key) {CODE
LOW…uci-app-frpc/htdocs/luci-static/resources/view/frpc.js1236function validateVirtualNetDestination(section, section_id, value) {CODE
LOW…uci-static/resources/view/strongswan-swanctl/status.js118function handleChildDetailsDismiss(connection) {CODE
LOW…uci-static/resources/view/strongswan-swanctl/status.js141function renderChildDetailsSection(childName, child) {CODE
LOW…uci-static/resources/view/strongswan-swanctl/status.js310function collectSwanmonErrorMessages(results) {CODE
LOW…ci-static/resources/view/strongswan-swanctl/swanctl.js696function getReferencingConnections(option, section_id, exclude, types) {CODE
LOW…ci-static/resources/view/strongswan-swanctl/swanctl.js825function handleConnectionModalSave(modalMap, ev) {CODE
LOW…ci-static/resources/view/strongswan-swanctl/swanctl.js846function handleConnectionModalCancel(modalMap, ev, isSaving) {CODE
LOW…m/htdocs/luci-static/resources/view/system/repokeys.js205function handleWindowDragDropIgnore(ev) {CODE
LOW…em/htdocs/luci-static/resources/view/system/sshkeys.js241function handleWindowDragDropIgnore(ev) {CODE
LOW…work/htdocs/luci-static/resources/view/network/dhcp.js114function generateDnsmasqInstanceEntry(d) {CODE
LOW…tdocs/luci-static/resources/view/status/connections.js154 function joinAddressWithPortOrServiceName(address, port, protocol) {CODE
LOW…sil/htdocs/luci-static/resources/protocol/yggdrasil.js32function validateYggdrasilListenUri(section_id,value) {CODE
LOW…ard/htdocs/luci-static/resources/protocol/wireguard.js91function handleWindowDragDropIgnore(ev) {CODE
Decorative Section Separators4 hits · 12 pts
SeverityFileLineSnippetContext
MEDIUM…plications/luci-app-advanced-reboot/tests/run_tests.sh16# ── Patch phase ─────────────────────────────────────────────────────COMMENT
MEDIUM…plications/luci-app-advanced-reboot/tests/run_tests.sh32# ── Device JSON validation ──────────────────────────────────────────COMMENT
MEDIUM…plications/luci-app-advanced-reboot/tests/run_tests.sh127# ── Mock-based functional tests ────────────────────────────────────COMMENT
MEDIUM…plications/luci-app-advanced-reboot/tests/run_tests.sh323# ── Shell script syntax checks ──────────────────────────────────────COMMENT
Slop Phrases1 hit · 2 pts
SeverityFileLineSnippetContext
MEDIUM…urces/view/plugins/d0ecde1b009d44ff82faa8b0ff219cef.js56 _('For demonstration purposes, the expected verification code. ' +CODE