AI Slop Code Risk Monitor

redcanaryco/atomic-red-team

SlopCodeMonitor badge for redcanaryco/atomic-red-team Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

Small and highly portable detection tests based on MITRE's ATT&CK.

1.2 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for redcanaryco/atomic-red-team, a C project with 12,747 GitHub stars. SynthScan examined 171,333 lines of code across 1007 source files, recording 113 pattern matches distributed across 12 syntactic categories. The legacy adjusted pattern signal is 1.2 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

1.2
Adjusted Signal
1.2
Raw Pattern Score
100%
Time Factor
2026-10-31
Last Push
12.7K
Stars
C
Language
171.3K
Lines of Code
1.0K
Files
113
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.0/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 88 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.2/100 · LOW

Are imports declared and package/API names verified? 4 finding(s).

Agent Over-Engineering Ratio 2.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 35 finding(s).

PR Review Velocity Impact 6.0/100 · LOW

Which changes need focused human review? 113 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 2MEDIUM 45LOW 66

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 113 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Decorative Section Separators16 hits · 48 pts
SeverityFileLineSnippetContext
MEDIUMatomics/T1027.018/T1027.018.yaml5# ------------------------------------------------------------COMMENT
MEDIUMatomics/T1027.018/T1027.018.yaml7# ------------------------------------------------------------COMMENT
MEDIUMatomics/T1027.018/T1027.018.yaml25# ------------------------------------------------------------COMMENT
MEDIUMatomics/T1027.018/T1027.018.yaml27# ------------------------------------------------------------COMMENT
MEDIUMatomics/T1027.018/T1027.018.yaml45# ------------------------------------------------------------COMMENT
MEDIUMatomics/T1027.018/T1027.018.yaml47# ------------------------------------------------------------COMMENT
MEDIUMatomics/T1137.005/T1137.005.yaml6# ============================================================COMMENT
MEDIUMatomics/T1137.005/T1137.005.yaml8# ============================================================COMMENT
MEDIUMatomics/T1137.005/T1137.005.yaml92# ============================================================COMMENT
MEDIUMatomics/T1137.005/T1137.005.yaml94# ============================================================COMMENT
MEDIUMatomics/T1137.005/T1137.005.yaml178# ============================================================COMMENT
MEDIUMatomics/T1137.005/T1137.005.yaml180# ============================================================COMMENT
MEDIUMatomics/T1137.005/T1137.005.yaml264# ============================================================COMMENT
MEDIUMatomics/T1137.005/T1137.005.yaml266# ============================================================COMMENT
MEDIUMatomics/T1137.005/T1137.005.yaml320# ============================================================COMMENT
MEDIUMatomics/T1137.005/T1137.005.yaml325# ============================================================COMMENT
Self-Referential Comments16 hits · 46 pts
SeverityFileLineSnippetContext
MEDIUMatomics/T1105/T1105.yaml1022 # Define the capability name for OpenSSH ClientCOMMENT
MEDIUMatomics/T1105/T1105.yaml1042 # Create the fileCOMMENT
MEDIUMatomics/T1105/T1105.yaml1091 # Define the capability name for OpenSSH ClientCOMMENT
MEDIUMatomics/T1105/T1105.yaml1147 # Define the capability name for OpenSSH ClientCOMMENT
MEDIUMatomics/T1105/T1105.yaml1166 # Create the fileCOMMENT
MEDIUMatomics/T1105/T1105.yaml1213 # Define the capability name for OpenSSH ClientCOMMENT
MEDIUMatomics/T1071/src/server.py5 # Create a socket objectCOMMENT
MEDIUMatomics/T1137.001/T1137.001.yaml54 # Define the path of copied normal template for restoralCOMMENT
MEDIUMatomics/T1137.001/T1137.001.yaml56 # Define the path to the normal templateCOMMENT
MEDIUMatomics/T1137.001/T1137.001.yaml75 # Create a new instance of Word.ApplicationCOMMENT
MEDIUMatomics/T1137.001/T1137.001.yaml108 # Define the path of copied normal template for restoralCOMMENT
MEDIUMatomics/T1137.001/T1137.001.yaml110 # Define the path to the normal templateCOMMENT
MEDIUMatomics/T1546/T1546.yaml106 # Create a CIM sessionCOMMENT
MEDIUMatomics/T1546/T1546.yaml109 # Define the process you want to startCOMMENT
MEDIUMatomics/T1486/T1486.yaml266 Set-Content -Path "#{File_to_Encrypt_Location}" -Value "populating this file with some text" # Create the test.txCODE
MEDIUMatomics/T1486/T1486.yaml274 Set-Content -Path "#{File_to_Encrypt_Location}" -Value "populating this file with some text" # Create the test.txCODE
Over-Commented Block36 hits · 36 pts
SeverityFileLineSnippetContext
LOWatomics/T1087.002/src/adcsv.pl1#****************************************************************************************COMMENT
LOWatomics/T1055/src/x64/RedVanity/vanity.h1//Check my codes for any errors, this is C code.COMMENT
LOWatomics/T1056.004/src/T1056.004/T1056.004.cpp1#define SECURITY_WIN32 //Define First Before Imports.COMMENT
LOWatomics/T1055.004/src/T1055.cpp1#define SECURITY_WIN32 //Define First Before Imports.COMMENT
LOWatomics/T1137.002/src/officetest/officetest/pch.h1// pch.h: This is a precompiled header file.COMMENT
LOWatomics/T1137.002/src/officetest/officetest/framework.h1#pragma onceCOMMENT
LOWatomics/T1110.001/src/sudo_bruteforce.sh1#!/bin/bashCOMMENT
LOWatomics/T1027.002/src/test.h1#ifndef TEST_HCOMMENT
LOWatomics/T1055.011/src/ntlib/ntddk.h1#ifndef __NTDLL_H__COMMENT
LOWatomics/T1055.011/src/ntlib/ntddk.h21#endifCOMMENT
LOWatomics/T1055.011/src/ntlib/ntddk.h41#endifCOMMENT
LOWatomics/T1055.011/src/ntlib/ntddk.h121//COMMENT
LOWatomics/T1055.011/src/ntlib/ntddk.h521RtlDeleteCriticalSection(COMMENT
LOWatomics/T1055.011/src/ntlib/ntddk.h1181#define RTL_QUERY_REGISTRY_TOPKEY 0x00000002 // Reset current key to original key forCOMMENT
LOWatomics/T1055.011/src/ntlib/ntddk.h1201 // If .Buffer field is NULL then a buffer isCOMMENT
LOWatomics/T1055.011/src/ntlib/ntddk.h1681NTAPICOMMENT
LOWatomics/T1055.011/src/ntlib/ntddk.h1701#endif // File create flagsCOMMENT
LOWatomics/T1055.011/src/ntlib/ntddk.h1721#define FILE_NO_COMPRESSION 0x00008000COMMENT
LOWatomics/T1055.011/src/ntlib/ntddk.h3681#define HEAP_REALLOC_IN_PLACE_ONLY 0x00000010COMMENT
LOWatomics/T1055.011/src/ntlib/util.h41#define _WIN32_DCOMCOMMENT
LOWatomics/T1055.011/src/ntlib/util.h61#include <stddef.h>COMMENT
LOWatomics/T1218/src/T1218.cpp1#define SECURITY_WIN32 //Define First Before Imports.COMMENT
LOWatomics/T1040/src/freebsd_pcapdemo.c1#include <fcntl.h>COMMENT
LOWatomics/T1040/src/linux_pcapdemo.c1#include <errno.h>COMMENT
LOWatomics/T1040/src/macos_pcapdemo.c1#include <fcntl.h>COMMENT
LOWatomics/T1574.012/src/atomicNotepad/pch.h1// pch.h: This is a precompiled header file.COMMENT
LOWatomics/T1574.012/src/atomicNotepad/framework.h1#pragma onceCOMMENT
LOWatomics/T1055.001/src/T1055.001.cpp1#define SECURITY_WIN32 //Define First Before Imports.COMMENT
LOWatomics/T1137.006/src/excelxll/excelxll/pch.h1// pch.h: This is a precompiled header file.COMMENT
LOWatomics/T1137.006/src/excelxll/excelxll/framework.h1#pragma onceCOMMENT
LOWatomics/T1137.006/src/wordwll/wordwll/pch.h1// pch.h: This is a precompiled header file.COMMENT
LOWatomics/T1137.006/src/wordwll/wordwll/framework.h1#pragma onceCOMMENT
LOW…ics/T1055.009/src/retAddr_overwrite_fullROPchain_inj.c1#define _GNU_SOURCECOMMENT
LOW…/T1055.009/src/rop_mprotect_return_address_overwrite.c1#define _GNU_SOURCECOMMENT
LOW…218.008/src/odbcconf net.40/Properties/AssemblyInfo.cs21COMMENT
LOW…218.008/src/odbcconf net.20/Properties/AssemblyInfo.cs21COMMENT
AI Slop Vocabulary9 hits · 26 pts
SeverityFileLineSnippetContext
MEDIUMatomics/T1218.004/T1218.004.yaml38 # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssemblyCOMMENT
MEDIUMatomics/T1218.004/T1218.004.yaml102 # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssemblyCOMMENT
MEDIUMatomics/T1218.004/T1218.004.yaml167 # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssemblyCOMMENT
MEDIUMatomics/T1218.004/T1218.004.yaml232 # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssemblyCOMMENT
MEDIUMatomics/T1218.004/T1218.004.yaml297 # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssemblyCOMMENT
MEDIUMatomics/T1218.004/T1218.004.yaml362 # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssemblyCOMMENT
MEDIUMatomics/T1218.004/T1218.004.yaml427 # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssemblyCOMMENT
MEDIUMatomics/T1218.004/T1218.004.yaml481 # Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssemblyCOMMENT
MEDIUM…tack-Navigator-Layers/art-navigator-layer-windows.json1{"name":"Atomic Red Team (Windows)","versions":{"attack":"18","navigator":"5.3.0","layer":"4.5"},"description":"Atomic RCODE
Hyper-Verbose Identifiers14 hits · 14 pts
SeverityFileLineSnippetContext
LOWatomic_red_team/labels.py12def get_technique_from_filename(filename):CODE
LOWatomic_red_team/labels.py147 def save_labels_and_maintainers(self, pr):CODE
LOWatomic_red_team/atomic_red_team.rb35 def atomic_tests_for_technique_by_platform(technique_or_technique_identifier, platform)CODE
LOWatomic_red_team/atomic_red_team.rb58 def atomic_tests_for_technique(technique_or_technique_identifier)CODE
LOWatomic_red_team/atomic_red_team.rb90 def atomic_yaml_has_test_for_platform(yaml_file, only_platform)CODE
LOWatomic_red_team/atomic_red_team.rb226 def add_guid_to_used_guid_file(guid, used_guids_file)CODE
LOWatomic_red_team/attack_api.rb35 def technique_identifier_for_technique(technique)CODE
LOWatomic_red_team/attack_api.rb55 def ordered_tactic_to_technique_matrix(only_platform: /.*/)CODE
LOWatomic_red_team/models.py187 def validate_elevation_required(self):CODE
LOWatomic_red_team/models.py247 def validate_dependency_executor_names(cls, data):CODE
LOWatomic_red_team/display_names.py13def load_current_technique_names(path: str = attack_data_file) -> Dict[str, str]:CODE
LOWatomic_red_team/tests/test_models.py70def atomic_manual_executor_builder():CODE
LOWatomic_red_team/tests/test_models.py86def atomic_command_executor_builder():CODE
LOWatomic_red_team/tests/test_validate.py14def test_all_invalid_scenarios(test_input):CODE
Redundant / Tautological Comments8 hits · 12 pts
SeverityFileLineSnippetContext
LOWatomics/T1105/T1105.yaml1036 # Check if the folder exists, create it if it doesn'tCOMMENT
LOWatomics/T1105/T1105.yaml1161 # Check if the folder exists, create it if it doesn'tCOMMENT
LOWatomics/T1071/src/server.py35 # Print output (decode if it's command data)COMMENT
LOWatomics/T1071/src/server.py47 # Print output (decode if it's command data)COMMENT
LOWatomics/T1071/src/server.py71 # Print output (decode if it's command data)COMMENT
LOWatomics/T1071/src/client.py20 # Check if output is emptyCOMMENT
LOWatomics/T1005/src/sqlite_dump.sh5# Check if the first command-line argument is emptyCOMMENT
LOWatomics/T1505.005/T1505.005.yaml51 # Check if the registry key existsCOMMENT
Excessive Try-Catch Wrapping4 hits · 8 pts
SeverityFileLineSnippetContext
MEDIUMatomics/T1056.001/src/MacOSKeylogger.swift293 print("Error: \(result)")CODE
MEDIUMatomics/T1056.001/src/MacOSKeylogger.swift301 print("Error: \(result)")CODE
MEDIUMatomics/T1056.001/src/MacOSKeylogger.swift315 catch {print("Error: \(error)")}CODE
MEDIUMatomic_red_team/runner.py126 print(f"Error occurred with {i.replace(f'{atomics_path}/', '')}.")CODE
Cross-Language Confusion (JS/TS)1 hit · 5 pts
SeverityFileLineSnippetContext
HIGHatomics/T1127/src/hello.js3print('Hello, \\ntoday is ' + d + '\\nand this is random - ' + n);CODE
Empty Error Handlers1 hit · 5 pts
SeverityFileLineSnippetContext
HIGHatomics/T1046/src/T1046.py11except:CODE
Deep Nesting5 hits · 5 pts
SeverityFileLineSnippetContext
LOWatomics/T1071/src/server.py4CODE
LOWatomic_red_team/validator.py59CODE
LOWatomic_red_team/labels.py99CODE
LOWatomic_red_team/runner.py106CODE
LOWatomic_red_team/models.py247CODE
Fake / Example Data2 hits · 2 pts
SeverityFileLineSnippetContext
LOWatomics/T1027.002/src/test.h7char *USELESS_VAR = " Lorem ipsum dolor sit amet, consectetur adipiscing elit. Vivamus varius dolor in nisi convallis, CODE
LOWatomics/T1027.002/src/test.h7char *USELESS_VAR = " Lorem ipsum dolor sit amet, consectetur adipiscing elit. Vivamus varius dolor in nisi convallis, CODE
Unused Imports1 hit · 1 pts
SeverityFileLineSnippetContext
LOWatomics/T1046/src/T1046.py1CODE