:ice_cube: 一个可爱且任性的 B 站视频下载器
This report summarizes scanner evidence for yutto-dev/yutto, a Python project with 2,064 GitHub stars. SynthScan examined 37,665 lines of code across 260 source files, recording 538 pattern matches distributed across 10 syntactic categories. The legacy adjusted pattern signal is 15.4 (Elevated pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 323 finding(s).
Are imports declared and package/API names verified? 204 finding(s).
Are wrappers, guards, and repeated structures necessary? 324 finding(s).
Which changes need focused human review? 538 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 538 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/test_auth.py | 14 | def test_parse_auth_inline_handles_case_and_spaces(): | CODE |
| LOW⚡ | tests/test_auth.py | 18 | def test_parse_auth_inline_requires_sessdata(): | CODE |
| LOW⚡ | tests/test_auth.py | 22 | def test_format_auth_inline_omits_empty_bili_jct(): | CODE |
| LOW⚡ | tests/test_auth.py | 26 | def test_resolve_auth_prefers_inline_auth(tmp_path: Path): | CODE |
| LOW | tests/test_auth.py | 39 | def test_resolve_auth_rejects_invalid_auth_file(tmp_path: Path): | CODE |
| LOW⚡ | tests/test_auth.py | 53 | def test_save_and_load_auth_round_trip(tmp_path: Path): | CODE |
| LOW⚡ | tests/test_auth.py | 61 | def test_save_auth_clears_stale_bili_jct(tmp_path: Path): | CODE |
| LOW⚡ | tests/test_auth.py | 71 | def test_load_auth_returns_none_for_invalid_file(tmp_path: Path): | CODE |
| LOW⚡ | tests/test_auth.py | 78 | def test_load_auth_rejects_invalid_profile(tmp_path: Path): | CODE |
| LOW⚡ | tests/test_auth.py | 83 | def test_remove_auth_removes_target_profile_only(tmp_path: Path): | CODE |
| LOW⚡ | tests/test_auth.py | 94 | def test_remove_auth_deletes_empty_auth_file(tmp_path: Path): | CODE |
| LOW⚡ | tests/test_auth.py | 103 | def test_remove_auth_returns_false_when_profile_missing(tmp_path: Path): | CODE |
| LOW⚡ | tests/test_auth.py | 109 | def test_remove_auth_rejects_invalid_existing_auth_file(tmp_path: Path): | CODE |
| LOW | tests/test_login.py | 22 | async def test_validate_saved_auth_uses_yutto_session_with_auth_cookies(monkeypatch: pytest.MonkeyPatch): | CODE |
| LOW | tests/test_login.py | 56 | def test_run_login_saves_and_validates_auth( | CODE |
| LOW | tests/test_login.py | 113 | async def test_poll_qr_login_reports_status_changes_and_returns_redirect( | CODE |
| LOW | tests/test_login.py | 153 | async def test_poll_qr_login_rejects_invalid_intervals(): | CODE |
| LOW | tests/test_login.py | 165 | async def test_complete_login_falls_back_to_redirect_query(capsys: pytest.CaptureFixture[str]): | CODE |
| LOW | tests/test_login.py | 183 | def test_get_cookie_value_probes_bilibili_domains_in_priority_order(): | CODE |
| LOW | tests/test_login.py | 244 | def test_auth_logout_removes_only_selected_profile_and_is_idempotent( | CODE |
| LOW | tests/test_login.py | 260 | def test_auth_logout_rejects_invalid_auth(tmp_path: Path, capsys: pytest.CaptureFixture[str], inline_auth: bool): | CODE |
| LOW⚡ | tests/test_cli.py | 65 | def test_download_parser_accepts_auth_file(tmp_path: Path): | CODE |
| LOW⚡ | tests/test_cli.py | 73 | def test_download_parser_rejects_auth_config(tmp_path: Path): | CODE |
| LOW⚡ | tests/test_cli.py | 82 | def test_download_parser_accepts_ffmpeg_path(): | CODE |
| LOW⚡ | tests/test_cli.py | 92 | def test_download_configures_ffmpeg_path_at_command_boundary(monkeypatch: pytest.MonkeyPatch): | CODE |
| LOW⚡ | tests/test_cli.py | 147 | def test_login_parser_accepts_auth_file(tmp_path: Path): | CODE |
| LOW⚡ | tests/test_cli.py | 155 | def test_login_parser_rejects_auth_config(tmp_path: Path): | CODE |
| LOW⚡ | tests/test_cli.py | 164 | def test_auth_status_parser_accepts_auth_file(tmp_path: Path): | CODE |
| LOW⚡ | tests/test_cli.py | 172 | def test_auth_logout_parser_accepts_auth_file(tmp_path: Path): | CODE |
| LOW⚡ | tests/test_cli.py | 180 | def test_root_parser_accepts_auth_login(tmp_path: Path): | CODE |
| LOW⚡ | tests/test_cli.py | 190 | def test_root_parser_accepts_auth_status(tmp_path: Path): | CODE |
| LOW⚡ | tests/test_cli.py | 200 | def test_root_parser_accepts_auth_logout(tmp_path: Path): | CODE |
| LOW | tests/test_cli.py | 119 | def test_download_validation_rejects_non_positive_num_workers(monkeypatch: pytest.MonkeyPatch): | CODE |
| LOW | tests/test_cli.py | 132 | def test_download_jobs_default_to_one_and_reject_non_positive_values(monkeypatch: pytest.MonkeyPatch): | CODE |
| LOW | tests/test_cli.py | 211 | def test_get_download_subparser_reports_missing_download(subcommand: str | None): | CODE |
| LOW | tests/test_cli.py | 219 | def test_progress_renderer_respects_no_progress(monkeypatch: pytest.MonkeyPatch): | CODE |
| LOW | tests/test_cli.py | 244 | def test_progress_bar_renders_committed_buffered_and_remaining_segments(monkeypatch: pytest.MonkeyPatch): | CODE |
| LOW | tests/test_cli.py | 297 | def test_progress_renderer_turns_only_buffered_segment_red(monkeypatch: pytest.MonkeyPatch): | CODE |
| LOW | tests/test_cli.py | 319 | def test_progress_renderer_tracks_multiple_items_and_removes_completed_rows(monkeypatch: pytest.MonkeyPatch): | CODE |
| LOW | tests/test_cli.py | 338 | def test_progress_renderer_aligns_and_truncates_labels(monkeypatch: pytest.MonkeyPatch): | CODE |
| LOW | tests/test_cli.py | 368 | def test_progress_renderer_compresses_bar_before_label( | CODE |
| LOW | tests/test_cli.py | 388 | def test_progress_renderer_avoids_wrapping_for_wide_stats(monkeypatch: pytest.MonkeyPatch): | CODE |
| LOW | tests/test_cli.py | 401 | def test_run_download_scopes_report_renderer_and_cleans_up_on_cancel(monkeypatch: pytest.MonkeyPatch): | CODE |
| LOW | tests/test_server/test_command.py | 22 | def test_serve_is_an_explicit_subcommand(): | CODE |
| LOW | tests/test_server/test_command.py | 31 | def test_serve_jobs_configures_download_runtime_workers(): | CODE |
| LOW | tests/test_server/test_command.py | 43 | def test_serve_accepts_ffmpeg_path(): | CODE |
| LOW | tests/test_server/test_command.py | 48 | def test_serve_configures_ffmpeg_path_at_command_boundary(monkeypatch: pytest.MonkeyPatch): | CODE |
| LOW | tests/test_server/test_command.py | 65 | def test_serve_argument_error_is_rendered_without_traceback( | CODE |
| LOW | tests/test_server/test_command.py | 104 | def test_environment_token_takes_precedence(tmp_path): | CODE |
| LOW | tests/test_server/test_command.py | 115 | def test_missing_token_file_is_created_with_a_generated_token(tmp_path): | CODE |
| LOW | tests/test_server/test_command.py | 127 | def test_empty_token_file_is_rejected(tmp_path): | CODE |
| LOW | tests/test_server/test_command.py | 138 | def test_existing_token_file_must_be_private_and_cannot_be_a_symlink(tmp_path): | CODE |
| LOW⚡ | tests/test_server/test_service.py | 120 | def test_prepare_request_rejects_subpath_template_escape(tmp_path: Path, template: str): | CODE |
| LOW⚡ | tests/test_server/test_service.py | 128 | def test_prepare_request_rejects_advanced_format_template_escape(tmp_path: Path, template: str): | CODE |
| LOW⚡ | tests/test_server/test_service.py | 135 | def test_prepare_request_marks_final_output_path_for_boundary_enforcement(tmp_path: Path): | CODE |
| LOW⚡ | tests/test_server/test_service.py | 155 | def test_policy_rejects_worker_counts_outside_configured_limits(tmp_path: Path, network: object): | CODE |
| LOW⚡ | tests/test_server/test_service.py | 162 | def test_prepare_request_rejects_invalid_auth_profile(tmp_path: Path): | CODE |
| LOW⚡ | tests/test_server/test_service.py | 170 | def test_policy_rejects_unsafe_block_sizes(tmp_path: Path, block_size: int): | CODE |
| LOW⚡ | tests/test_server/test_service.py | 177 | def test_policy_rejects_ffmpeg_save_codecs_outside_server_capabilities(tmp_path: Path): | CODE |
| LOW | tests/test_server/test_service.py | 66 | def test_prepare_request_resolves_output_paths_under_server_roots(tmp_path: Path): | CODE |
| 252 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/conftest.py | 1 | CODE | |
| LOW | tests/test_auth.py | 1 | CODE | |
| LOW | tests/test_login.py | 1 | CODE | |
| LOW | tests/test_e2e.py | 1 | CODE | |
| LOW | tests/test_cli.py | 1 | CODE | |
| LOW | tests/test_server/test_command.py | 1 | CODE | |
| LOW | tests/test_server/test_command.py | 5 | CODE | |
| LOW | tests/test_server/test_command.py | 17 | CODE | |
| LOW | tests/test_server/test_service.py | 1 | CODE | |
| LOW | tests/test_server/test_websocket.py | 1 | CODE | |
| LOW | tests/test_server/__init__.py | 1 | CODE | |
| LOW | tests/test_server/test_rpc.py | 1 | CODE | |
| LOW | tests/test_utils/test_filter.py | 1 | CODE | |
| LOW | tests/test_utils/test_formatter.py | 1 | CODE | |
| LOW | tests/test_utils/test_asynclib.py | 1 | CODE | |
| LOW | tests/test_utils/test_status_bar.py | 1 | CODE | |
| LOW | tests/test_utils/test_data_access.py | 1 | CODE | |
| LOW | tests/test_utils/test_fetcher.py | 1 | CODE | |
| LOW | tests/test_utils/test_ffmpeg.py | 1 | CODE | |
| LOW | tests/test_utils/test_ffmpeg.py | 23 | CODE | |
| LOW | tests/test_runtime/test_tasks.py | 1 | CODE | |
| LOW | tests/test_core/test_result.py | 1 | CODE | |
| LOW | tests/test_core/test_request.py | 1 | CODE | |
| LOW | tests/test_core/test_task_service.py | 1 | CODE | |
| LOW | tests/test_core/test_execution.py | 1 | CODE | |
| LOW | tests/test_core/test_application.py | 1 | CODE | |
| LOW | tests/test_core/test_native_session.py | 1 | CODE | |
| LOW | tests/test_api/test_user_info.py | 1 | CODE | |
| LOW | tests/test_api/test_cheese.py | 1 | CODE | |
| LOW | tests/test_api/test_space.py | 1 | CODE | |
| LOW | tests/test_api/test_bangumi.py | 1 | CODE | |
| LOW | tests/test_api/test_bangumi.py | 3 | CODE | |
| LOW | tests/test_api/test_bangumi.py | 8 | CODE | |
| LOW | tests/test_api/test_collection.py | 1 | CODE | |
| LOW | tests/test_api/test_ugc_video.py | 1 | CODE | |
| LOW | tests/test_api/test_danmaku.py | 1 | CODE | |
| LOW | tests/test_processor/test_resolve.py | 1 | CODE | |
| LOW | tests/test_processor/test_selector.py | 1 | CODE | |
| LOW | tests/test_processor/test_subtitle_languages.py | 1 | CODE | |
| LOW | tests/test_processor/test_download_result.py | 1 | CODE | |
| LOW | tests/test_processor/test_download_result.py | 6 | CODE | |
| LOW | tests/test_processor/test_download_result.py | 25 | CODE | |
| LOW | tests/test_processor/test_download_result.py | 25 | CODE | |
| LOW | tests/test_processor/test_path_leases.py | 1 | CODE | |
| LOW | tests/test_processor/test_audio_save_codec.py | 1 | CODE | |
| LOW | tests/test_processor/test_download_planner.py | 1 | CODE | |
| LOW | tests/test_processor/test_structured_errors.py | 1 | CODE | |
| LOW | tests/test_processor/test_batch_resolve.py | 1 | CODE | |
| LOW | tests/test_processor/test_downloader.py | 1 | CODE | |
| LOW | tests/test_processor/test_manager_semantics.py | 1 | CODE | |
| LOW | tests/test_processor/test_path_resolver.py | 1 | CODE | |
| LOW | tests/test_processor/test_download_lifecycle.py | 1 | CODE | |
| LOW | tests/helpers/http_range_server.py | 1 | CODE | |
| LOW | scripts/prepare-ci-cache.py | 1 | CODE | |
| LOW | scripts/get-version.py | 1 | CODE | |
| LOW | scripts/generate-schema.py | 1 | CODE | |
| LOW | packages/biliass/src/biliass/__init__.py | 1 | CODE | |
| LOW | packages/biliass/src/biliass/__init__.py | 3 | CODE | |
| LOW | packages/biliass/src/biliass/__init__.py | 3 | CODE | |
| LOW | packages/biliass/src/biliass/__init__.py | 8 | CODE | |
| 143 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/yutto/server/command.py | 51 | except FileNotFoundError: | CODE |
| HIGH | src/yutto/utils/ffmpeg.py | 104 | except ProcessLookupError: | CODE |
| HIGH | src/yutto/utils/console/attributes.py | 27 | except (AttributeError, ValueError, OSError): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_server/test_websocket.py | 464 | CODE | |
| LOW | tests/test_server/test_websocket.py | 553 | CODE | |
| LOW | packages/biliass/src/biliass/biliass.py | 18 | CODE | |
| LOW | src/yutto/input_parser.py | 65 | CODE | |
| LOW | src/yutto/login.py | 179 | CODE | |
| LOW | src/yutto/runtime/tasks.py | 529 | CODE | |
| LOW | src/yutto/downloader/executor.py | 30 | CODE | |
| LOW | src/yutto/utils/danmaku.py | 78 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/yutto/login.py | 105 | except Exception as e: | CODE |
| LOW | src/yutto/login.py | 174 | except Exception as e: | CODE |
| LOW | src/yutto/login.py | 303 | except Exception as e: | CODE |
| LOW | src/yutto/runtime/tasks.py | 557 | except Exception as error: | CODE |
| LOW | src/yutto/server/rpc.py | 129 | except Exception: | CODE |
| LOW | src/yutto/utils/asynclib.py | 50 | except Exception as error: | CODE |
| LOW | src/yutto/utils/console/formatter.py | 68 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_server/test_rpc.py | 58 | response = await dispatcher.dispatch('{"jsonrpc":"2.0","method":"record","params":{"value":"request"},"id":null}') | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | skills/bilibili-video-download/SKILL.md | 157 | ## Input validation and security guardrails | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docs/guide/cli/batch.md | 41 | # 如果我们只想下载第 3 话，只需要这样 | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/biliass/src/biliass/biliass.py | 18 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/yutto/_native.py | 20 | __all__ = [ | CODE |