{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:07.216920Z","repo":{"ref":{"host":"github.com","owner":"riesentoaster","name":"oss-fuzz-format-ident"},"default_branch":"main","clone_url":"https://github.com/riesentoaster/oss-fuzz-format-ident.git","html_url":"https://github.com/riesentoaster/oss-fuzz-format-ident","description":null,"stars":0,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":5401,"primary_language":"Python","license_spdx":null,"created_at":"2026-06-30T12:53:27Z","pushed_at":"2026-08-06T11:24:53Z","security_policy_url":null,"distribution":{"owner_created_at":"2017-04-09T13:01:57Z","owner_type":"User","release_assets":[]}},"commit_sha":"55fddac32949ab96a26f8fa25a1acaa147b7f2a0","profile":{"lines_by_language":{"Python":757},"files_by_category":{"source":7,"config":3,"docs":1,"oversized":1},"source_lines":757,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.41,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":39.9,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":51.1,"duplication":84.1,"lint":47.2,"testing":0.0,"docs":40.0,"type_safety":40.0,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 22% of function code in complex or long functions; 3% duplicated lines. Weakest area: testing."},"security":{"score":72.6,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":64.6,"dependencies":null,"ci_actions":null,"posture":20.0,"scorecard":null},"summary":"Security posture is adequate: 1 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":4.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":764.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2026-06":{"loc":764,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":2.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":764.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":180.0,"median_loc_per_hour":180.0,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":757.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":3.0,"findings_high":1.0,"findings_medium":2.0,"findings_low":0.0,"weighted_findings":1.25,"scanned_lines":757.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"oss_fuzz_format_detector/extractors.py","line":79,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:oss_fuzz_format_detector/extractors.py:79"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"oss_fuzz_format_detector/download.py","line":27,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:oss_fuzz_format_detector/download.py:27"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"oss_fuzz_format_detector/download.py","line":39,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:oss_fuzz_format_detector/download.py:39"}],"evidence":[],"data":{"rulesets":["python"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":1.0,"signed_commit_share":0.5,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":33.0,"function_nloc":501.0,"mean_ccn":5.33,"p90_ccn":12.0,"complex_functions":2.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.2236},"findings":[],"evidence":[{"kind":"complex-function","description":"label_observations in oss_fuzz_format_detector/labeler.py: complexity 22, 56 lines","ref":"oss_fuzz_format_detector/labeler.py","url":"https://github.com/riesentoaster/oss-fuzz-format-ident/blob/55fddac32949ab96a26f8fa25a1acaa147b7f2a0/oss_fuzz_format_detector/labeler.py#L29","weight":0.36666666666666664},{"kind":"complex-function","description":"main in detect_formats.py: complexity 21, 56 lines","ref":"detect_formats.py","url":"https://github.com/riesentoaster/oss-fuzz-format-ident/blob/55fddac32949ab96a26f8fa25a1acaa147b7f2a0/detect_formats.py#L168","weight":0.35}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":556.0,"duplicated_lines":16.0,"duplicated_share":0.0288,"files":7.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: detect_formats.py:51 and detect_formats.py:155","ref":"detect_formats.py","url":"https://github.com/riesentoaster/oss-fuzz-format-ident/blob/55fddac32949ab96a26f8fa25a1acaa147b7f2a0/detect_formats.py#L51","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":1.0,"weighted_findings":3.0,"scanned_lines":757.0,"category:correctness":1.0},"findings":[{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'tmp.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'tmp.name' is used. Use '.flush()' or close the file before using 'tmp.name'.","path":"oss_fuzz_format_detector/extractors.py","line":130,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:oss_fuzz_format_detector/extractors.py:130"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":757.0,"test_ratio":0.0,"ci_files":0.0,"cochange_share":0.0,"cochange_commits":2.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":0.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":144.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}