AdamLaurie/raiden-pico
Raiden for the pico2 written by claude code
unreviewed-ai-risk
- Repository: https://github.com/AdamLaurie/raiden-pico
- Commit:
101db56516a5f38113c83a11ff86c3aa38ef6475 - Generated: 2026-11-13T23:47:16+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
Unreviewed AI code risk: a large share of this code is explicitly AI-attributed, and its tests or review process are weak while quality or security scores are low.
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 93 | explicit | 95% | 100% |
| Code quality | 31 | poor | 90% | 100% |
| Security | 74 | adequate | 85% | 100% |
AI provenance
Explicit AI attribution on 93% of first-party code added; an estimated 93% including velocity signals.
- Explicitly attributed share (lower bound): 93.0%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 93.0%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 170 | 41,097 |
- AI tooling configured in repo: claude-code
Current source lines last changed by AI-attributed commits: 31,235 of 33,402.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 6.403 | 0.0 | n/a |
| Security | 0.928 | 8.306 | 0.11x |
- Stylometry index: 0.93 per 1,000 lines (narrated steps 26, placeholders 0, assistant phrasing 0, emoji 10). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-10 | 4,871 | 39% |
| 2025-11 | 7,839 | 100% |
| 2025-12 | 4,413 | 98% |
| 2026-01 | 1,791 | 100% |
| 2026-02 | 1,308 | 100% |
| 2026-03 | 8,454 | 100% |
| 2026-04 | 3,492 | 100% |
| 2026-05 | 1,086 | 100% |
| 2026-06 | 4,455 | 100% |
| 2026-09 | 2,533 | 100% |
| 2026-10 | 3,221 | 100% |
| 2026-11 | 736 | 100% |
Evidence
- Claude Code: trailer 'Co-Authored-By: Claude' (101db56516a5)
- Claude Code: trailer 'Co-Authored-By: Claude' (f83e67ccc1e8)
- Claude Code: trailer 'Co-Authored-By: Claude' (9807f3ada818)
- Claude Code: trailer 'Co-Authored-By: Claude' (e708a4756a87)
- Claude Code: trailer 'Co-Authored-By: Claude' (15a3b9509a6f)
- Claude Code: trailer 'Co-Authored-By: Claude' (ec009bf40a5f)
- Claude Code: trailer 'Co-Authored-By: Claude' (7c012586e38c)
- Claude Code: trailer 'Co-Authored-By: Claude' (a157c3167884)
- Claude Code: trailer 'Co-Authored-By: Claude' (b164bbc9ec6a)
- Claude Code: trailer 'Co-Authored-By: Claude' (405722450fce)
- Claude Code: trailer 'Co-Authored-By: Claude' (a4f7f583f8f0)
- Claude Code: trailer 'Co-Authored-By: Claude' (74f8b70881aa)
- Claude Code: trailer 'Co-Authored-By: Claude' (eaffac70251d)
- Claude Code: trailer 'Co-Authored-By: Claude' (1a00dd7cd365)
- Claude Code: trailer 'Co-Authored-By: Claude' (60ff5157f36d)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is poor: test-to-source ratio 0.19, no CI test run detected; 54% of function code in complex or long functions; 14% duplicated lines. Weakest area: lint.
| Area | Score |
|---|---|
| Complexity (lizard) | 20 |
| Duplication | 42 |
| Code smells (Opengrep) | 0 |
| Tests and CI | 40 |
| Documentation | 60 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 694; mean complexity 7.6, 90th percentile 16; 71 complex and 26 long functions
- Duplicated lines: 14.4% of 26,460 compared
- Tests: 6,338 test lines for 33,402 source lines (ratio 0.19); CI test commands: none detected; 26% of recent source commits also change tests
- Docs missing or thin: license, contributing
Most complex functions:
- command_parser_execute in src/command_parser.c: complexity 1081, 3648 lines
- target_power_halt in src/target_uart.c: complexity 77, 312 lines
- target_power_bypass in src/target_uart.c: complexity 59, 258 lines
- romgadget_run in src/target_uart.c: complexity 57, 207 lines
- target_power_shadowbypass in src/target_uart.c: complexity 55, 163 lines
Security
Security posture is adequate: 56 known vulnerabilities in 3 dependencies; 13 high-severity SAST findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 83 |
| Vulnerable dependencies (OSV) | 70 |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 56 in 3 packages (critical 8, high 33, medium 13, low 0)
-
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-9j59-75qj-795w: [email protected] (PyPI) is affected by PYSEC-2022-168, GHSA-9j59-75qj-795w; also in requirements.txt |
requirements-dev.txt |
| critical | osv/GHSA-5x8w-8jj5-q52h: [email protected] (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h; also in requirements.txt |
requirements-dev.txt |
| critical | osv/GHSA-8g5g-8vmr-9782: [email protected] (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782; also in requirements.txt |
requirements-dev.txt |
| critical | osv/GHSA-xvh5-g6gv-559v: [email protected] (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v; also in requirements.txt |
requirements-dev.txt |
| critical | osv/GHSA-3f63-hfp8-52jq: [email protected] (PyPI) is affected by PYSEC-2026-457, GHSA-3f63-hfp8-52jq; also in requirements.txt |
requirements-dev.txt |
| critical | osv/GHSA-332p-7hrc-92wf: [email protected] (PyPI) is affected by GHSA-332p-7hrc-92wf; also in requirements.txt |
requirements-dev.txt |
| critical | osv/GHSA-8vj2-vxx3-667w: [email protected] (PyPI) is affected by GHSA-8vj2-vxx3-667w; also in requirements.txt |
requirements-dev.txt |
| critical | osv/GHSA-w889-685w-c8fh: [email protected] (PyPI) is affected by GHSA-w889-685w-c8fh; also in requirements.txt |
requirements-dev.txt |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
jtag_glitch_heatmap.py:592 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/auto_glitch_explorer.py:142 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/openocd_crp_trace.py:52 |
| high | opengrep/python.lang.security.audit.subprocess-shell-true: Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. [confidence medium] |
scripts/openocd_crp_trace.py:84 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/openocd_crp_trace.py:112 |
| high | opengrep/python.lang.security.audit.subprocess-shell-true: Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. [confidence medium] |
scripts/openocd_crp_trace.py:114 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/openocd_crp_trace_rom.py:26 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/openocd_crp_trace_simple.py:25 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/openocd_crp_trace_working.py:26 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/optimize_params.py:41 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/optimize_timing.py:46 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/optimize_timing_fine.py:40 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/write_crp_protection.py:43 |
| high | osv/GHSA-44wm-f244-xhp3: [email protected] (PyPI) is affected by PYSEC-2026-1793, GHSA-44wm-f244-xhp3; also in requirements.txt |
requirements-dev.txt |
| high | osv/GHSA-j7hp-h8jx-5ppr: [email protected] (PyPI) is affected by PYSEC-2026-1794, GHSA-j7hp-h8jx-5ppr; also in requirements.txt |
requirements-dev.txt |
| high | osv/GHSA-8v84-f9pq-wr9x: [email protected] (PyPI) is affected by PYSEC-2026-2253, GHSA-8v84-f9pq-wr9x; also in requirements.txt |
requirements-dev.txt |
| high | osv/GHSA-5x94-69rx-g8h2: [email protected] (PyPI) is affected by PYSEC-2026-2254, GHSA-5x94-69rx-g8h2; also in requirements.txt |
requirements-dev.txt |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 33,402; test lines: 6,338
| Language | Lines |
|---|---|
| C | 20,981 |
| Python | 18,462 |
| Shell | 297 |