Leaderboard github.com
78/xiaozhi-esp32
An MCP-based chatbot | 一个基于MCP的聊天机器人
AI provenance
7%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
59/100
weak
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
64/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
7% explicit
Explicit AI attribution on 7% of first-party code added; an estimated 7% including velocity signals.
How the score is built
- Explicitly attributed share7%
- Unattributed share in AI-pace bursts22%
- Estimated AI-generated share7%
- AI tool configuration files1
- Work sessions at AI pace2
- Releases at AI pace1
- Coding-style index (1.0+ means possible)0.00
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| OpenAI Codex | 34 | 12,768 | 2026-05-28 | 2026-11-13 |
| Claude Code | 27 | 4,441 | 2026-04-30 | 2026-10-29 |
| Cursor agent | 10 | 2,176 | 2026-06-07 | 2026-10-16 |
| GitHub Copilot coding agent | 13 | 721 | 2025-11-10 | 2026-10-19 |
Lines added per month all AI-attributed share
- 2024-081,999 · 0% AI
- 2024-09995 · 0% AI
- 2024-103,862 · 0% AI
- 2024-1156,230 · 0% AI
- 2024-122,718 · 0% AI
- 2025-016,322 · 0% AI
- 2025-029,291 · 0% AI
- 2025-0313,657 · 0% AI
- 2025-045,808 · 0% AI
- 2025-0511,285 · 0% AI
- 2025-068,751 · 0% AI
- 2025-079,043 · 0% AI
- 2025-083,862 · 0% AI
- 2025-0913,063 · 0% AI
- 2025-106,127 · 0% AI
- 2025-116,682 · 2% AI
- 2025-126,026 · 0% AI
- 2026-017,273 · 0% AI
- 2026-027,084 · 0% AI
- 2026-035,821 · 0% AI
- 2026-046,082 · 1% AI
- 2026-052,628 · 3% AI
- 2026-064,000 · 4% AI
- 2026-0713,803 · 38% AI
- 2026-086,087 · 14% AI
- 2026-098,947 · 44% AI
- 2026-1017,315 · 28% AI
- 2026-114,036 · 76% AI
Findings in AI-attributed lines vs the rest
From git blame: 12,178 lines trace to AI-attributed commits, 126,308 to others. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.08 | 0.29 | 0.28× |
| Security | 0.25 | 0.12 | 2.07× |
Evidence by analyzer
Explicit AI attributionok29 items
- OpenAI Codex: 34 attributed commits, 12,768 lines added
- Claude Code: 27 attributed commits, 4,441 lines added
- GitHub Copilot coding agent: 13 attributed commits, 721 lines added
- Cursor agent: 10 attributed commits, 2,176 lines added
- OpenAI Codex: PR branch 'codex/fix-cst3530-dependency-condition'
- OpenAI Codex: PR branch 'codex/bump-version-2.6.0'
- OpenAI Codex: PR branch 'codex/mcp-20260728'
- OpenAI Codex: PR branch 'codex/mqtt-udp-probe-client'
- OpenAI Codex: PR branch 'codex/fix-camera-upload-write-count'
- OpenAI Codex: on merged branch (2aed8049ea)
- OpenAI Codex: on merged branch (05895ce20e)
- OpenAI Codex: on merged branch (9d49da8a1c)
- OpenAI Codex: on merged branch (a012725019)
- OpenAI Codex: on merged branch (a012725019)
- OpenAI Codex: on merged branch (a012725019)
- OpenAI Codex: on merged branch (05895ce20e)
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- OpenAI Codex: on merged branch (42099e2b55)
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- attributed_commit_share
- 7.2%
- attributed_commits
- 82
- attributed_loc
- 18,395
- attributed_loc_share
- 7.4%
- commits
- 1,132
- effective_loc
- 248,797
- tools_detected
- 4
AI tool configurationok1 item
- artifacts
- 1
- earliest_adoption
- 2026-07-18
- tools_configured
- 1
- workflow_agents
- 0
Commit velocityok2 items
- 51,403 lines of first-party code in ~4.0h (12,851 lines/hour, 1 commit session)
- 2,395 lines of first-party code in ~4.0h (599 lines/hour, 1 commit session)
- excluded_import_loc
- 0
- flagged_loc
- 53,798
- flagged_loc_share
- 21.6%
- flagged_units
- 2
- max_loc_per_hour
- 12,850.75
- measured_loc
- 248,797
- median_loc_per_hour
- 30.88
- pr_timed_units
- 480
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 805
Release velocityok1 item
- flagged_releases
- 1
- max_loc_per_day
- 17,105.10
- releases
- 71
Coding styleok
- count:assistant_voice
- 0
- count:emoji_in_code
- 0
- count:narrated_steps
- 0
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 0
- files:narrated_steps
- 0
- files:placeholder
- 0
- index
- 0
- lines_scanned
- 138,486
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0
- per_kloc:narrated_steps
- 0
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 12,178
- blame_failures
- 0
- files_blamed
- 711
- other_lines
- 126,308
- quality:ai_findings
- 1
- quality:ai_per_kloc
- 0.08
- quality:other_findings
- 37
- quality:other_per_kloc
- 0.29
- quality:ratio
- 0.28
- security:ai_findings
- 3
- security:ai_per_kloc
- 0.25
- security:other_findings
- 15
- security:other_per_kloc
- 0.12
- security:ratio
- 2.07
Code quality
59 weak
Code quality is weak: test-to-source ratio 0.05, CI runs tests; 14% of function code in complex or long functions; 46% duplicated lines. Weakest area: duplication.
How the score is built
- Complexity65
- Duplication6
- Lint and smells92
- Tests and CI65
- Documentation65
- Type safety40
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- OttoController::ActionTask in main/boards/otto-robot/otto_controller.cc: complexity 96, 298 lines
- EspVideo::Capture in main/boards/common/esp_video.cc: complexity 77, 421 lines
- SscmaCamera::SscmaCamera in main/boards/sensecap-watcher/sscma_camera.cc: complexity 77, 339 lines
- main in scripts/build.py: complexity 65, 210 lines
- EspVideo::EspVideo in main/boards/common/esp_video.cc: complexity 59, 222 lines
- McpServer::ParseMessage in main/mcp_server.cc: complexity 57, 129 lines
- OggDemuxer::Process in main/audio/demuxer/ogg_demuxer.cc: complexity 53, 247 lines
- Assets::LvglStrategy::Apply in main/assets.cc: complexity 52, 165 lines
- AfeAudioEngine::Initialize in main/audio/engines/afe_audio_engine.cc: complexity 49, 189 lines
- OttoController::RegisterMcpTools in main/boards/otto-robot/otto_controller.cc: complexity 45, 276 lines
- complex_functions
- 90
- function_nloc
- 80,701
- functions
- 5,280
- long_functions
- 49
- many_param_functions
- 77
- mean_ccn
- 2.84
- p90_ccn
- 6
- risky_nloc_share
- 14.3%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: main/application.cc:679 and main/application.cc:695
- 6+ duplicated lines: main/assets.cc:382 and main/assets.cc:406
- 6+ duplicated lines: main/assets.cc:503 and main/ota.cc:319
- 6+ duplicated lines: main/assets.h:71 and main/assets.h:87
- 6+ duplicated lines: main/audio/audio_service.cc:135 and main/audio/audio_service.cc:153
- 6+ duplicated lines: main/audio/codecs/box_audio_codec.cc:23 and main/audio/codecs/es8311_audio_codec.cc:22
- 6+ duplicated lines: main/audio/codecs/box_audio_codec.cc:29 and main/boards/espressif/esp32-s3-box-lite/box_audio_codec_lite.cc:31
- 6+ duplicated lines: main/audio/codecs/box_audio_codec.cc:37 and main/boards/m5stack/atoms3r-echo-pyramid/atoms3r_echo_pyramid.cc:295
- 6+ duplicated lines: main/audio/codecs/box_audio_codec.cc:44 and main/boards/sensecap-watcher/sensecap_audio_codec.cc:39
- 6+ duplicated lines: main/audio/codecs/box_audio_codec.cc:59 and main/boards/m5stack/tab5/tab5_audio_codec.cc:55
- compared_lines
- 99,861
- duplicated_lines
- 45,503
- duplicated_share
- 45.6%
- files
- 711
Lintok
- category:best-practice
- 6
- category:correctness
- 4
- category:maintainability
- 28
- findings
- 38
- scanned_lines
- 138,486
- weighted_findings
- 45.25
Tests and CIok4 items
- CI config: .github/workflows/build.yml
.github/workflows/build.yml - CI config: .github/workflows/release.yml
.github/workflows/release.yml - CI config: .github/workflows/test-mcp.yml
.github/workflows/test-mcp.yml - CI runs tests (unittest)
- check:ci_present
- yes
- check:ci_runs_lint
- no
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- no
- ci_files
- 3
- cochange_commits
- 223
- cochange_share
- 19.7%
- source_lines
- 138,486
- test_lines
- 7,058
- test_ratio
- 0.05
Documentationok2 items
- README.md
README.md - LICENSE
LICENSE
- check:changelog
- no
- check:contributing
- no
- check:license
- yes
- check:readme
- yes
- readme_lines
- 130
Type safetyok
- check:low_escape_density
- yes
- check:strict_config
- no
- escapes
- 16
- escapes_per_kloc
- 1.88
Security
64 weak
Security posture is weak: 63 known vulnerabilities in 3 dependencies; 11 high-severity SAST findings; 11 high-severity workflow issues. Weakest area: ci actions.
How the score is built
- Secrets79
- Static analysis (SAST)97
- Vulnerable dependencies73
- CI workflows11
- Security posture20
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 10
- declared
- 10
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 2
- secrets_nonprod
- 5
Static analysis (opengrep)ok
- findings
- 19
- findings_high
- 11
- findings_low
- 1
- findings_medium
- 7
- parse_errors
- 6
- scanned_lines
- 138,486
- weighted_findings
- 12.35
Dependencies (osv-scanner)ok
- penalty
- 19
- vulnerabilities
- 63
- vulnerable_packages
- 3
- vulns_critical
- 6
- vulns_high
- 38
- vulns_low
- 1
- vulns_medium
- 17
- vulns_unknown
- 1
CI workflows (zizmor)ok
- findings
- 19
- findings_high
- 11
- findings_low
- 8
- findings_medium
- 0
- penalty
- 133.80
- workflows
- 3
Security postureok
- check:dependency_updates
- no
- check:lockfiles
- yes
- check:security_policy
- no
- check:signed_commits
- yes
- signed_commit_share
- 57.0%
- unpinned_manifests
- 0
Release downloadsok5 items
- release v2.6.0 ships v2.6.0_alientek-atk-dnesp32s3-box.zip (61 downloads)
- release v2.6.0 ships v2.6.0_alientek-atk-dnesp32s3-box0.zip (21 downloads)
- release v2.6.0 ships v2.6.0_alientek-atk-dnesp32s3-box2-4g.zip (20 downloads)
- release v2.6.0 ships v2.6.0_alientek-atk-dnesp32s3-box2-wifi.zip (25 downloads)
- release v2.6.0 ships v2.6.0_alientek-atk-dnesp32s3-box3.zip (21 downloads)
- binary_assets
- 1,525
- signals
- 1
- suspicious
- 0
Findings
6 critical64 high58 medium16 low2 info
146 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| critical | osv/GHSA-332p-7hrc-92wf |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-332p-7hrc-92wf | Dependencies (osv-scanner) |
| critical | osv/GHSA-5x8w-8jj5-q52h |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h | Dependencies (osv-scanner) |
| critical | osv/GHSA-8g5g-8vmr-9782 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782 | Dependencies (osv-scanner) |
| critical | osv/GHSA-v9pv-5gc8-w2m6 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4339, GHSA-v9pv-5gc8-w2m6 | Dependencies (osv-scanner) |
| critical | osv/GHSA-w889-685w-c8fh |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-w889-685w-c8fh | Dependencies (osv-scanner) |
| critical | osv/GHSA-xvh5-g6gv-559v |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v | Dependencies (osv-scanner) |
| high | opengrep/python.lang.correctness.tempfile.tempfile-without-flush |
scripts/Image_Converter/lvgl_tools_gui.py:233 | Using 'tmpfile.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'tmpfile.name' is used. Use '.flush()' or close the file before using 'tmpfile.name'. | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.identical-is-comparison |
scripts/build.py:1127 | Found identical comparison using is. Ensure this is what you intended. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
scripts/p3_tools/p3_gui_player.py:177 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
scripts/p3_tools/p3_gui_player.py:42 | time.sleep() call; did you mean to leave this in? | Lint |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:101 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:27 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:84 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:103 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:107 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:112 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:30 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:56 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:74 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:88 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/test-mcp.yml:27 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | opengrep/dockerfile.security.missing-user-entrypoint |
docker/firmware-builder/Dockerfile:32 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
docker/firmware-builder/firmware_builder.py:190 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
docker/firmware-builder/firmware_builder.py:212 | Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/Image_Converter/LVGLImage.py:84 | Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.subprocess-shell-true |
scripts/Image_Converter/LVGLImage.py:87 | Found 'subprocess' function 'check_output' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a... | Static analysis (opengrep) |
| high | osv/GHSA-22hg-r758-rrw9 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-22hg-r758-rrw9 | Dependencies (osv-scanner) |
| high | osv/GHSA-27h8-gf7j-v5hc |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4326, GHSA-27h8-gf7j-v5hc | Dependencies (osv-scanner) |
| high | osv/GHSA-3j72-p6qg-6xp7 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4341, GHSA-3j72-p6qg-6xp7 | Dependencies (osv-scanner) |
| high | osv/GHSA-4558-3h8r-v8xp |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4327, GHSA-4558-3h8r-v8xp | Dependencies (osv-scanner) |
| high | osv/GHSA-45hq-cxwh-f6vc |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2255, GHSA-45hq-cxwh-f6vc | Dependencies (osv-scanner) |
| high | osv/GHSA-4rr5-89j8-mwwm |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4328, GHSA-4rr5-89j8-mwwm | Dependencies (osv-scanner) |
| high | osv/GHSA-58r4-6rv3-gfh8 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4329, GHSA-58r4-6rv3-gfh8 | Dependencies (osv-scanner) |
| high | osv/GHSA-5x94-69rx-g8h2 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2254, GHSA-5x94-69rx-g8h2 | Dependencies (osv-scanner) |
| high | osv/GHSA-5xm2-6676-qcp9 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-5xm2-6676-qcp9 | Dependencies (osv-scanner) |
| high | osv/GHSA-62p4-gmf7-7g93 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3493, GHSA-62p4-gmf7-7g93 | Dependencies (osv-scanner) |
| high | osv/GHSA-65qm-jvmh-6pqg |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-65qm-jvmh-6pqg | Dependencies (osv-scanner) |
| high | osv/GHSA-6r8x-57c9-28j4 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3451, GHSA-6r8x-57c9-28j4 | Dependencies (osv-scanner) |
| high | osv/GHSA-78g4-xqwv-q3g8 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-78g4-xqwv-q3g8 | Dependencies (osv-scanner) |
| high | osv/GHSA-7mwm-ghpf-9vrm |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4331, GHSA-7mwm-ghpf-9vrm | Dependencies (osv-scanner) |
| high | osv/GHSA-8v84-f9pq-wr9x |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2253, GHSA-8v84-f9pq-wr9x | Dependencies (osv-scanner) |
| high | osv/GHSA-9hw9-ch79-4vh6 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3453, GHSA-9hw9-ch79-4vh6 | Dependencies (osv-scanner) |
| high | osv/GHSA-9v9v-9qvf-h2hj |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4343, GHSA-9v9v-9qvf-h2hj | Dependencies (osv-scanner) |
| high | osv/GHSA-c6hw-5grf-ff96 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-c6hw-5grf-ff96 | Dependencies (osv-scanner) |
| high | osv/GHSA-cfh3-3jmp-rvhc |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2249, GHSA-cfh3-3jmp-rvhc | Dependencies (osv-scanner) |
| high | osv/GHSA-f2g6-542v-9j58 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-f2g6-542v-9j58 | Dependencies (osv-scanner) |
| high | osv/GHSA-g4qv-2jxx-769h |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4342, GHSA-g4qv-2jxx-769h | Dependencies (osv-scanner) |
| high | osv/GHSA-g7cr-3p24-7wf7 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-g7cr-3p24-7wf7 | Dependencies (osv-scanner) |
| high | osv/GHSA-g842-9rc4-69pw |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4338, GHSA-g842-9rc4-69pw | Dependencies (osv-scanner) |
| high | osv/GHSA-gg2r-wvfm-q9rx |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-gg2r-wvfm-q9rx | Dependencies (osv-scanner) |
| high | osv/GHSA-j4m9-6w36-pw47 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-j4m9-6w36-pw47 | Dependencies (osv-scanner) |
| high | osv/GHSA-jg86-v3jv-hrpm |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-jg86-v3jv-hrpm | Dependencies (osv-scanner) |
| high | osv/GHSA-jjj6-mw9f-p565 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3495, GHSA-jjj6-mw9f-p565 | Dependencies (osv-scanner) |
| high | osv/GHSA-mrfp-p49p-3hf2 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-mrfp-p49p-3hf2 | Dependencies (osv-scanner) |
| high | osv/GHSA-p4wg-p73j-c528 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-p4wg-p73j-c528 | Dependencies (osv-scanner) |
| high | osv/GHSA-pchr-8j38-3x4p |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4334, GHSA-pchr-8j38-3x4p | Dependencies (osv-scanner) |
| high | osv/GHSA-phj9-mv4w-65pm |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2256, GHSA-phj9-mv4w-65pm | Dependencies (osv-scanner) |
| high | osv/GHSA-pwv6-vv43-88gr |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2252, GHSA-pwv6-vv43-88gr | Dependencies (osv-scanner) |
| high | osv/GHSA-q45j-58j2-45rg |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-q45j-58j2-45rg | Dependencies (osv-scanner) |
| high | osv/GHSA-vjc4-5qp5-m44j |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3496, GHSA-vjc4-5qp5-m44j | Dependencies (osv-scanner) |
| high | osv/GHSA-whj4-6x5x-4v2j |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2250, GHSA-whj4-6x5x-4v2j | Dependencies (osv-scanner) |
| high | osv/GHSA-xcvg-w56q-r89m |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-xcvg-w56q-r89m | Dependencies (osv-scanner) |
| high | osv/GHSA-xgh8-jp6q-p5x8 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4335, GHSA-xgh8-jp6q-p5x8 | Dependencies (osv-scanner) |
| high | osv/GHSA-xj96-63gp-2gmr |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3454, GHSA-xj96-63gp-2gmr | Dependencies (osv-scanner) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/build.py:77 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/publish_firmware.py:162 | Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/spiffs_assets/build.py:385 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/spiffs_assets/build.py:62 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/spiffs_assets/build_all.py:55 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/spiffs_assets/spiffs_assets_gen.py:245 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/Image_Converter/LVGLImage.py:178 | Is "is_alpha_only" a function or an attribute? If it is a function, you may have meant self.is_alpha_only() because self.is_alpha_only is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/Image_Converter/LVGLImage.py:178 | Is "is_indexed" a function or an attribute? If it is a function, you may have meant self.is_indexed() because self.is_indexed is always true. | Lint |
| medium | opengrep/python.lang.best-practice.unspecified-open-encoding |
scripts/Image_Converter/LVGLImage.py:372 | Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/Image_Converter/LVGLImage.py:586 | Is "is_indexed" a function or an attribute? If it is a function, you may have meant self.cf.is_indexed() because self.cf.is_indexed is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/Image_Converter/LVGLImage.py:674 | Is "is_indexed" a function or an attribute? If it is a function, you may have meant self.is_indexed() because self.is_indexed is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/Image_Converter/LVGLImage.py:687 | Is "is_indexed" a function or an attribute? If it is a function, you may have meant self.cf.is_indexed() because self.cf.is_indexed is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/Image_Converter/LVGLImage.py:793 | Is "is_indexed" a function or an attribute? If it is a function, you may have meant self.cf.is_indexed() because self.cf.is_indexed is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/Image_Converter/LVGLImage.py:809 | Is "is_alpha_only" a function or an attribute? If it is a function, you may have meant self.cf.is_alpha_only() because self.cf.is_alpha_only is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/Image_Converter/LVGLImage.py:824 | Is "is_colormap" a function or an attribute? If it is a function, you may have meant self.cf.is_colormap() because self.cf.is_colormap is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/Image_Converter/LVGLImage.py:861 | Is "is_indexed" a function or an attribute? If it is a function, you may have meant cf.is_indexed() because cf.is_indexed is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/Image_Converter/LVGLImage.py:863 | Is "is_alpha_only" a function or an attribute? If it is a function, you may have meant cf.is_alpha_only() because cf.is_alpha_only is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/Image_Converter/LVGLImage.py:865 | Is "is_luma_only" a function or an attribute? If it is a function, you may have meant cf.is_luma_only() because cf.is_luma_only is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/Image_Converter/LVGLImage.py:867 | Is "is_colormap" a function or an attribute? If it is a function, you may have meant cf.is_colormap() because cf.is_colormap is always true. | Lint |
| medium | opengrep/python.requests.best-practice.use-timeout |
scripts/download_github_runs.py:112 | Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a... | Lint |
| medium | opengrep/python.requests.best-practice.use-timeout |
scripts/download_github_runs.py:76 | Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a... | Lint |
| medium | opengrep/python.lang.correctness.use-sys-exit |
scripts/gen_lang.py:187 | Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/p3_tools/p3_gui_player.py:154 | Is "is_paused" a function or an attribute? If it is a function, you may have meant self.is_paused() because self.is_paused is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/p3_tools/p3_gui_player.py:155 | Is "is_paused" a function or an attribute? If it is a function, you may have meant self.is_paused() because self.is_paused is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/p3_tools/p3_gui_player.py:160 | Is "is_playing" a function or an attribute? If it is a function, you may have meant self.is_playing() because self.is_playing is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/p3_tools/p3_gui_player.py:163 | Is "is_playing" a function or an attribute? If it is a function, you may have meant self.is_playing() because self.is_playing is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/p3_tools/p3_gui_player.py:205 | Is "is_playing" a function or an attribute? If it is a function, you may have meant self.is_playing() because self.is_playing is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/p3_tools/p3_gui_player.py:206 | Is "is_paused" a function or an attribute? If it is a function, you may have meant self.is_paused() because self.is_paused is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/p3_tools/p3_gui_player.py:210 | Is "is_playing" a function or an attribute? If it is a function, you may have meant self.is_playing() because self.is_playing is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/p3_tools/p3_gui_player.py:211 | Is "is_paused" a function or an attribute? If it is a function, you may have meant self.is_paused() because self.is_paused is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/p3_tools/p3_gui_player.py:211 | Is "is_paused" a function or an attribute? If it is a function, you may have meant self.is_paused() because self.is_paused is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/p3_tools/p3_gui_player.py:212 | Is "is_paused" a function or an attribute? If it is a function, you may have meant self.is_paused() because self.is_paused is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/p3_tools/p3_gui_player.py:220 | Is "is_playing" a function or an attribute? If it is a function, you may have meant self.is_playing() because self.is_playing is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/p3_tools/p3_gui_player.py:220 | Is "is_paused" a function or an attribute? If it is a function, you may have meant self.is_paused() because self.is_paused is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/p3_tools/p3_gui_player.py:221 | Is "is_playing" a function or an attribute? If it is a function, you may have meant self.is_playing() because self.is_playing is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/p3_tools/p3_gui_player.py:222 | Is "is_paused" a function or an attribute? If it is a function, you may have meant self.is_paused() because self.is_paused is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/p3_tools/p3_gui_player.py:83 | Is "is_playing" a function or an attribute? If it is a function, you may have meant self.is_playing() because self.is_playing is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
scripts/p3_tools/p3_gui_player.py:84 | Is "is_paused" a function or an attribute? If it is a function, you may have meant self.is_paused() because self.is_paused is always true. | Lint |
| medium | opengrep/python.requests.best-practice.use-timeout |
scripts/versions.py:201 | Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a... | Lint |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
docker/firmware-builder/firmware_builder.py:321 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| medium | opengrep/c.lang.security.function-use-after-free |
main/boards/espressif/esp32-s3-lcd-ev-board-2/esp_lcd_gc9503.c:410 | Variable 'gc9503' was passed to a function after being freed. This can lead to undefined behavior. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/c.lang.security.function-use-after-free |
main/boards/espressif/esp32-s3-lcd-ev-board/esp_lcd_gc9503.c:410 | Variable 'gc9503' was passed to a function after being freed. This can lead to undefined behavior. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/c.lang.security.function-use-after-free |
main/boards/kevin/yuying-313lcd/esp_lcd_gc9503.c:384 | Variable 'gc9503' was passed to a function after being freed. This can lead to undefined behavior. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/c.lang.security.insecure-use-memset |
main/display/lvgl_display/gif/gifdec.c:119 | When handling sensitive information in a buffer, it's important to ensure that the data is securely erased before the buffer is deleted or reused. While `memset()` is commonly used for this purpose, it can leave sensitive information... | Static analysis (opengrep) |
| medium | opengrep/c.lang.security.insecure-use-memset |
main/display/lvgl_display/gif/gifdec.c:137 | When handling sensitive information in a buffer, it's important to ensure that the data is securely erased before the buffer is deleted or reused. While `memset()` is commonly used for this purpose, it can leave sensitive information... | Static analysis (opengrep) |
| medium | osv/GHSA-24rc-8hj2-v98c |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-24rc-8hj2-v98c | Dependencies (osv-scanner) |
| medium | osv/GHSA-254f-3936-288h |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-254f-3936-288h | Dependencies (osv-scanner) |
| medium | osv/GHSA-462x-pgg6-55fp |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-462x-pgg6-55fp | Dependencies (osv-scanner) |
| medium | osv/GHSA-4rm8-3hmm-39fg |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4340, GHSA-4rm8-3hmm-39fg | Dependencies (osv-scanner) |
| medium | osv/GHSA-4x4j-2g7c-83w6 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2257, GHSA-4x4j-2g7c-83w6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-5xmw-vc9v-4wf2 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2251, GHSA-5xmw-vc9v-4wf2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-654x-cwwv-5j9c |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4336, GHSA-654x-cwwv-5j9c | Dependencies (osv-scanner) |
| medium | osv/GHSA-74r2-7ff9-mjj2 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-74r2-7ff9-mjj2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-fc9g-5qg7-mf45 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-fc9g-5qg7-mf45 | Dependencies (osv-scanner) |
| medium | osv/GHSA-fj7v-r99m-22gq |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3494, GHSA-fj7v-r99m-22gq | Dependencies (osv-scanner) |
| medium | osv/GHSA-p8hx-v2p6-rp84 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4337, GHSA-p8hx-v2p6-rp84 | Dependencies (osv-scanner) |
| medium | osv/GHSA-r73j-pqj5-w3x7 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2874, GHSA-r73j-pqj5-w3x7 | Dependencies (osv-scanner) |
| medium | osv/GHSA-rfgq-q3w2-pmv2 |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-rfgq-q3w2-pmv2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-vx6w-vv9f-6gvg |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-vx6w-vv9f-6gvg | Dependencies (osv-scanner) |
| medium | osv/GHSA-wjx4-4jcj-g98j |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-165, GHSA-wjx4-4jcj-g98j | Dependencies (osv-scanner) |
| medium | osv/GHSA-wqgw-9xfh-qf2g |
scripts/Image_Converter/requirements.txt | [email protected] (PyPI) is affected by GHSA-wqgw-9xfh-qf2g | Dependencies (osv-scanner) |
| medium | osv/GHSA-6p56-wp2h-9hxr |
scripts/p3_tools/requirements.txt | [email protected] (PyPI) is affected by GHSA-6p56-wp2h-9hxr | Dependencies (osv-scanner) |
| medium | osv/GHSA-fpfv-jqm9-f5jm |
scripts/p3_tools/requirements.txt | [email protected] (PyPI) is affected by GHSA-fpfv-jqm9-f5jm | Dependencies (osv-scanner) |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
scripts/spiffs_assets/spiffs_assets_gen.py:127 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/mp3_to_ogg.sh:3 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | zizmor/artipacked |
.github/workflows/build.yml:26 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/build.yml:83 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/release.yml:103 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/release.yml:30 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/release.yml:74 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/test-mcp.yml:27 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | gitleaks/generic-api-key |
docs/mcp-protocol.md:145 | Possible generic-api-key secret in history (commit 17e35145f3); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
docs/mcp-protocol_zh.md:138 | Possible generic-api-key secret in history (commit 17e35145f3); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
docs/mqtt-udp.md:124 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
docs/mqtt-udp_zh.md:121 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
main/boards/m5stack-tab5/sdkconfig.tab5:2161 | Possible generic-api-key secret in history (commit f7ea248845); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | opengrep/python.lang.security.audit.network.avoid-bind-to-all-interfaces |
scripts/audio_debug_server.py:13 | Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file.... | Static analysis (opengrep) |
| low | gitleaks/generic-api-key |
scripts/license_tools/README.md:133 | Possible generic-api-key secret in history (commit ee4a2ab5fc); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | osv/GHSA-g7vv-2v7x-gj9p |
scripts/p3_tools/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1976, GHSA-g7vv-2v7x-gj9p | Dependencies (osv-scanner) |
| low | gitleaks/generic-api-key |
sdkconfig.box:1863 | Possible generic-api-key secret in history (commit a2487f46c8); removed from the current tree but still retrievable | Secrets (gitleaks) |
| info | zizmor/template-injection |
.github/workflows/release.yml:134 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/release.yml:134 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-5 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-5 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 38 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 19 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 63 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 19 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 7 |
Score history
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 4de00aed7405 | prov-5+qual-2+sec-2 | 7% | 59 | 64 |
Full text report
- Repository: https://github.com/78/xiaozhi-esp32
- Commit:
4de00aed740595a8713b01f8332b9b2cf30685bc - Generated: 2026-11-14T15:08:34+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 7 | explicit | 95% | 100% |
| Code quality | 59 | weak | 90% | 100% |
| Security | 64 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 7% of first-party code added; an estimated 7% including velocity signals.
- Explicitly attributed share (lower bound): 7.4%
- Unattributed share in AI-consistent velocity bursts: 21.6%
- Estimated AI-generated share: 7.4%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| OpenAI Codex | 34 | 12,768 |
| Claude Code | 27 | 4,441 |
| GitHub Copilot coding agent | 13 | 721 |
| Cursor agent | 10 | 2,176 |
- AI tooling configured in repo: generic-agent
Current source lines last changed by AI-attributed commits: 12,178 of 138,486.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.082 | 0.293 | 0.28x |
| Security | 0.246 | 0.119 | 2.07x |
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-12 | 6,026 | 0% |
| 2026-01 | 7,273 | 0% |
| 2026-02 | 7,084 | 0% |
| 2026-03 | 5,821 | 0% |
| 2026-04 | 6,082 | 1% |
| 2026-05 | 2,628 | 3% |
| 2026-06 | 4,000 | 4% |
| 2026-07 | 13,803 | 38% |
| 2026-08 | 6,087 | 14% |
| 2026-09 | 8,947 | 44% |
| 2026-10 | 17,315 | 28% |
| 2026-11 | 4,036 | 76% |
Evidence
- OpenAI Codex: PR branch 'codex/fix-cst3530-dependency-condition' (4de00aed7405)
- OpenAI Codex: PR branch 'codex/bump-version-2.6.0' (67ca62d4bb7d)
- OpenAI Codex: PR branch 'codex/mcp-20260728' (69f22bf2bb63)
- OpenAI Codex: PR branch 'codex/mqtt-udp-probe-client' (5b1dbe0e0058)
- OpenAI Codex: PR branch 'codex/fix-camera-upload-write-count' (59efe48e34ac)
- OpenAI Codex: on merged branch (2aed8049ea) (58b2884b7e34)
- OpenAI Codex: on merged branch (05895ce20e) (58b1b8e7a488)
- OpenAI Codex: on merged branch (9d49da8a1c) (96738235e87f)
- OpenAI Codex: on merged branch (a012725019) (8746347302dc)
- OpenAI Codex: on merged branch (a012725019) (4007326258d5)
- OpenAI Codex: on merged branch (a012725019) (5d863f551b46)
- OpenAI Codex: on merged branch (05895ce20e) (28890ed1a36a)
- Claude Code: trailer 'Co-Authored-By: Claude' (5badb80a9494)
- Claude Code: trailer 'Co-Authored-By: Claude' (e1046dc6dd33)
- Claude Code: trailer 'Co-authored-by: Claude' (c435f99a8806)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.05, CI runs tests; 14% of function code in complex or long functions; 46% duplicated lines. Weakest area: duplication.
| Area | Score |
|---|---|
| Complexity (lizard) | 65 |
| Duplication | 6 |
| Code smells (Opengrep) | 92 |
| Tests and CI | 65 |
| Documentation | 65 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 5,280; mean complexity 2.8, 90th percentile 6; 90 complex and 49 long functions
- Duplicated lines: 45.6% of 99,861 compared
- Tests: 7,058 test lines for 138,486 source lines (ratio 0.05); CI test commands: unittest; 20% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- OttoController::ActionTask in main/boards/otto-robot/otto_controller.cc: complexity 96, 298 lines
- EspVideo::Capture in main/boards/common/esp_video.cc: complexity 77, 421 lines
- SscmaCamera::SscmaCamera in main/boards/sensecap-watcher/sscma_camera.cc: complexity 77, 339 lines
- main in scripts/build.py: complexity 65, 210 lines
- EspVideo::EspVideo in main/boards/common/esp_video.cc: complexity 59, 222 lines
Security
Security posture is weak: 63 known vulnerabilities in 3 dependencies; 11 high-severity SAST findings; 11 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 79 |
| Static analysis (Opengrep) | 97 |
| Vulnerable dependencies (OSV) | 73 |
| CI workflows (zizmor) | 11 |
| Posture (policy, updates, signing, lockfiles) | 20 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 63 in 3 packages (critical 6, high 38, medium 17, low 1)
-
Posture checks passed: signed commits, lockfiles; missing: security policy, dependency updates
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-5x8w-8jj5-q52h: [email protected] (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h |
scripts/Image_Converter/requirements.txt |
| critical | osv/GHSA-8g5g-8vmr-9782: [email protected] (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782 |
scripts/Image_Converter/requirements.txt |
| critical | osv/GHSA-v9pv-5gc8-w2m6: [email protected] (PyPI) is affected by PYSEC-2026-4339, GHSA-v9pv-5gc8-w2m6 |
scripts/Image_Converter/requirements.txt |
| critical | osv/GHSA-xvh5-g6gv-559v: [email protected] (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v |
scripts/Image_Converter/requirements.txt |
| critical | osv/GHSA-332p-7hrc-92wf: [email protected] (PyPI) is affected by GHSA-332p-7hrc-92wf |
scripts/Image_Converter/requirements.txt |
| critical | osv/GHSA-w889-685w-c8fh: [email protected] (PyPI) is affected by GHSA-w889-685w-c8fh |
scripts/Image_Converter/requirements.txt |
| high | opengrep/dockerfile.security.missing-user-entrypoint: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
docker/firmware-builder/Dockerfile:32 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
docker/firmware-builder/firmware_builder.py:190 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
docker/firmware-builder/firmware_builder.py:212 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/Image_Converter/LVGLImage.py:84 |
| high | opengrep/python.lang.security.audit.subprocess-shell-true: Found 'subprocess' function 'check_output' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. [confidence medium] |
scripts/Image_Converter/LVGLImage.py:87 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/build.py:77 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/publish_firmware.py:162 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/spiffs_assets/build.py:62 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/spiffs_assets/build.py:385 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/spiffs_assets/build_all.py:55 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/spiffs_assets/spiffs_assets_gen.py:245 |
| high | osv/GHSA-cfh3-3jmp-rvhc: [email protected] (PyPI) is affected by PYSEC-2026-2249, GHSA-cfh3-3jmp-rvhc |
scripts/Image_Converter/requirements.txt |
| high | osv/GHSA-whj4-6x5x-4v2j: [email protected] (PyPI) is affected by PYSEC-2026-2250, GHSA-whj4-6x5x-4v2j |
scripts/Image_Converter/requirements.txt |
| high | osv/GHSA-pwv6-vv43-88gr: [email protected] (PyPI) is affected by PYSEC-2026-2252, GHSA-pwv6-vv43-88gr |
scripts/Image_Converter/requirements.txt |
| high | osv/GHSA-8v84-f9pq-wr9x: [email protected] (PyPI) is affected by PYSEC-2026-2253, GHSA-8v84-f9pq-wr9x |
scripts/Image_Converter/requirements.txt |
| high | osv/GHSA-5x94-69rx-g8h2: [email protected] (PyPI) is affected by PYSEC-2026-2254, GHSA-5x94-69rx-g8h2 |
scripts/Image_Converter/requirements.txt |
| high | osv/GHSA-45hq-cxwh-f6vc: [email protected] (PyPI) is affected by PYSEC-2026-2255, GHSA-45hq-cxwh-f6vc |
scripts/Image_Converter/requirements.txt |
| high | osv/GHSA-phj9-mv4w-65pm: [email protected] (PyPI) is affected by PYSEC-2026-2256, GHSA-phj9-mv4w-65pm |
scripts/Image_Converter/requirements.txt |
| high | osv/GHSA-6r8x-57c9-28j4: [email protected] (PyPI) is affected by PYSEC-2026-3451, GHSA-6r8x-57c9-28j4 |
scripts/Image_Converter/requirements.txt |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v2.6.0 ships v2.6.0_alientek-atk-dnesp32s3-box.zip (61 downloads)
- binary-release-asset: release v2.6.0 ships v2.6.0_alientek-atk-dnesp32s3-box0.zip (21 downloads)
- binary-release-asset: release v2.6.0 ships v2.6.0_alientek-atk-dnesp32s3-box2-4g.zip (20 downloads)
- binary-release-asset: release v2.6.0 ships v2.6.0_alientek-atk-dnesp32s3-box2-wifi.zip (25 downloads)
- binary-release-asset: release v2.6.0 ships v2.6.0_alientek-atk-dnesp32s3-box3.zip (21 downloads)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 138,486; test lines: 7,058
| Language | Lines |
|---|---|
| C++ | 92,562 |
| C | 37,414 |
| Python | 15,555 |
| Shell | 13 |