Leaderboard github.com

Ces107/agent-forge

Free agent skills and Claude Code plugins: launch-check (pre-launch audit of any URL: exposed keys, open database, SEO, phone design) and done-gate (no "done" until the tests pass). SKILL.md format for Claude Code, Codex, Cursor and Copilot.

View repository ↗
Python
★ 0
commit 20bf7ef688c3
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

explicit

Confidence: 95%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

54/100

weak

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

69/100

weak

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

8% explicit

Explicit AI attribution on 8% of first-party code added; an estimated 8% including velocity signals.

How the score is built

Explicitly attributed share8%
Unattributed share in AI-pace bursts77%
Estimated AI-generated share8%
AI tool configuration files5
Work sessions at AI pace4
Releases at AI pacenot measured
Coding-style index (1.0+ means possible)0.04

Attributed AI tools

Tool	Commits	Lines added	First seen	Last seen
Claude Code	5	2,404	2026-06-01	2026-06-01

Lines added per month all AI-attributed share

2026-064,488 · 54% AI
2026-1026,174 · 0% AI

Findings in AI-attributed lines vs the rest

From git blame: 663 lines trace to AI-attributed commits, 25,121 to others. Reported, not scored.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Code quality	1.51	0.84	1.80×
Security	0.00	0.64	0.00×

Evidence by analyzer

Explicit AI attributionok6 items

Claude Code: 5 attributed commits, 2,404 lines added
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'

attributed_commit_share: 3.8%
attributed_commits: 5
attributed_loc: 2,404
attributed_loc_share: 7.8%
commits: 130
effective_loc: 30,662
tools_detected: 1

AI tool configurationok5 items

artifacts: 5
earliest_adoption: 2026-06-01
tools_configured: 1
workflow_agents: 0

Commit velocityok4 items

excluded_import_loc: 0
flagged_loc: 23,566
flagged_loc_share: 76.9%
flagged_units: 4
max_loc_per_hour: 3,196.17
measured_loc: 30,662
median_loc_per_hour: 215.06
pr_timed_units: 0
pre_ai_era_burst_loc: 0
pre_ai_era_bursts: 0
pre_ai_era_measured_loc: 0
work_units: 15

Release velocityskipped

Coding styleok

count:assistant_voice: 0
count:emoji_in_code: 2
count:narrated_steps: 0
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 1
files:narrated_steps: 0
files:placeholder: 0
index: 0.04
lines_scanned: 25,784
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0.08
per_kloc:narrated_steps: 0
per_kloc:placeholder: 0

Findings in AI-written linesok

ai_lines: 663
blame_failures: 0
files_blamed: 43
other_lines: 25,121
quality:ai_findings: 1
quality:ai_per_kloc: 1.51
quality:other_findings: 21
quality:other_per_kloc: 0.84
quality:ratio: 1.80
security:ai_findings: 0
security:ai_per_kloc: 0
security:other_findings: 16
security:other_per_kloc: 0.64
security:ratio: 0

Code quality

54 weak

Code quality is weak: test-to-source ratio 0.14, CI runs tests; 49% of function code in complex or long functions; 68% duplicated lines. Weakest area: duplication.

How the score is built

Complexity23
Duplication2
Lint and smells76
Tests and CI82
Documentation65
Type safety100
Review processnot measured

Evidence by analyzer

Complexity (lizard)ok10 items

complex_functions: 121
function_nloc: 15,060
functions: 917
long_functions: 14
many_param_functions: 15
mean_ccn: 8.73
p90_ccn: 18
risky_nloc_share: 49.3%

Duplication (jscpd)ok10 items

compared_lines: 21,632
duplicated_lines: 14,637
duplicated_share: 67.7%
files: 43

Lintok

category:best-practice: 3
category:correctness: 9
category:maintainability: 10
findings: 22
scanned_lines: 25,784
weighted_findings: 28

Tests and CIok4 items

CI config: .github/workflows/ci.yml .github/workflows/ci.yml
CI config: .github/workflows/launch-check-keepalive.yml .github/workflows/launch-check-keepalive.yml
CI runs tests (pytest)
CI runs linters (ruff, mypy)

check:ci_present: yes
check:ci_runs_lint: yes
check:ci_runs_tests: yes
check:has_tests: yes
check:test_ratio: no
check:tests_cochange: yes
ci_files: 2
cochange_commits: 111
cochange_share: 38.7%
source_lines: 25,784
test_lines: 3,691
test_ratio: 0.14

Documentationok2 items

README.md README.md
LICENSE LICENSE

check:changelog: no
check:contributing: no
check:license: yes
check:readme: yes
readme_lines: 181

Type safetyok1 item

Python strict type checking: forge/pyproject.toml forge/pyproject.toml

check:low_escape_density: yes
check:strict_config: yes
escapes: 19
escapes_per_kloc: 0.74

Security

69 weak

Security posture is weak: 54 known vulnerabilities in 1 dependencies; 3 high-severity SAST findings; 6 high-severity workflow issues. Weakest area: posture.

How the score is built

Secrets100
Static analysis (SAST)90
Vulnerable dependencies78
CI workflows24
Security posture0
OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok

checked: 11
declared: 11
lookup_errors: 0
missing: 0
recent: 0

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 0
secrets_nonprod: 0

Static analysis (opengrep)ok

findings: 17
findings_high: 3
findings_low: 0
findings_medium: 14
parse_errors: 6
scanned_lines: 25,784
weighted_findings: 7.85

Dependencies (osv-scanner)ok

penalty: 15
vulnerabilities: 54
vulnerable_packages: 1
vulns_critical: 5
vulns_high: 35
vulns_low: 0
vulns_medium: 13
vulns_unknown: 1

CI workflows (zizmor)ok

findings: 13
findings_high: 6
findings_low: 0
findings_medium: 7
penalty: 85.20
workflows: 2

Security postureok

check:dependency_updates: no
check:lockfiles: yes
check:security_policy: no
check:signed_commits: no
signed_commit_share: 0.0%
unpinned_manifests: 0

Release downloadsok

binary_assets: 0
signals: 0
suspicious: 0

Findings

5 critical47 high54 medium

Severity	Rule	Location	Message	Tool
critical	`osv/GHSA-332p-7hrc-92wf`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-332p-7hrc-92wf	Dependencies (osv-scanner)
critical	`osv/GHSA-5x8w-8jj5-q52h`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h	Dependencies (osv-scanner)
critical	`osv/GHSA-8g5g-8vmr-9782`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782	Dependencies (osv-scanner)
critical	`osv/GHSA-w889-685w-c8fh`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-w889-685w-c8fh	Dependencies (osv-scanner)
critical	`osv/GHSA-xvh5-g6gv-559v`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v	Dependencies (osv-scanner)
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	web/launch-check/app.py:1793	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	web/launch-check/app.py:1798	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	workspaces/ledger/src/ledger/service.py:131	time.sleep() call; did you mean to leave this in?	Lint
high	`zizmor/unpinned-uses`	.github/workflows/ci.yml:16	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yml:17	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yml:37	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yml:38	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yml:62	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yml:65	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	forge/orchestrator.py:124	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`osv/GHSA-22hg-r758-rrw9`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-22hg-r758-rrw9	Dependencies (osv-scanner)
high	`osv/GHSA-27h8-gf7j-v5hc`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4326, GHSA-27h8-gf7j-v5hc	Dependencies (osv-scanner)
high	`osv/GHSA-3j72-p6qg-6xp7`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4341, GHSA-3j72-p6qg-6xp7	Dependencies (osv-scanner)
high	`osv/GHSA-4558-3h8r-v8xp`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4327, GHSA-4558-3h8r-v8xp	Dependencies (osv-scanner)
high	`osv/GHSA-45hq-cxwh-f6vc`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2255, GHSA-45hq-cxwh-f6vc	Dependencies (osv-scanner)
high	`osv/GHSA-58r4-6rv3-gfh8`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4329, GHSA-58r4-6rv3-gfh8	Dependencies (osv-scanner)
high	`osv/GHSA-5x94-69rx-g8h2`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2254, GHSA-5x94-69rx-g8h2	Dependencies (osv-scanner)
high	`osv/GHSA-5xm2-6676-qcp9`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-5xm2-6676-qcp9	Dependencies (osv-scanner)
high	`osv/GHSA-62p4-gmf7-7g93`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-3493, GHSA-62p4-gmf7-7g93	Dependencies (osv-scanner)
high	`osv/GHSA-65qm-jvmh-6pqg`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-65qm-jvmh-6pqg	Dependencies (osv-scanner)
high	`osv/GHSA-6r8x-57c9-28j4`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-3451, GHSA-6r8x-57c9-28j4	Dependencies (osv-scanner)
high	`osv/GHSA-7mwm-ghpf-9vrm`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4331, GHSA-7mwm-ghpf-9vrm	Dependencies (osv-scanner)
high	`osv/GHSA-8v84-f9pq-wr9x`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2253, GHSA-8v84-f9pq-wr9x	Dependencies (osv-scanner)
high	`osv/GHSA-9hw9-ch79-4vh6`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-3453, GHSA-9hw9-ch79-4vh6	Dependencies (osv-scanner)
high	`osv/GHSA-9v9v-9qvf-h2hj`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4343, GHSA-9v9v-9qvf-h2hj	Dependencies (osv-scanner)
high	`osv/GHSA-c6hw-5grf-ff96`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-c6hw-5grf-ff96	Dependencies (osv-scanner)
high	`osv/GHSA-cfh3-3jmp-rvhc`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2249, GHSA-cfh3-3jmp-rvhc	Dependencies (osv-scanner)
high	`osv/GHSA-f2g6-542v-9j58`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-f2g6-542v-9j58	Dependencies (osv-scanner)
high	`osv/GHSA-g7cr-3p24-7wf7`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-g7cr-3p24-7wf7	Dependencies (osv-scanner)
high	`osv/GHSA-g842-9rc4-69pw`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4338, GHSA-g842-9rc4-69pw	Dependencies (osv-scanner)
high	`osv/GHSA-gg2r-wvfm-q9rx`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-gg2r-wvfm-q9rx	Dependencies (osv-scanner)
high	`osv/GHSA-j4m9-6w36-pw47`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-j4m9-6w36-pw47	Dependencies (osv-scanner)
high	`osv/GHSA-jg86-v3jv-hrpm`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-jg86-v3jv-hrpm	Dependencies (osv-scanner)
high	`osv/GHSA-jjj6-mw9f-p565`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-3495, GHSA-jjj6-mw9f-p565	Dependencies (osv-scanner)
high	`osv/GHSA-mrfp-p49p-3hf2`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-mrfp-p49p-3hf2	Dependencies (osv-scanner)
high	`osv/GHSA-p4wg-p73j-c528`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-p4wg-p73j-c528	Dependencies (osv-scanner)
high	`osv/GHSA-pchr-8j38-3x4p`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4334, GHSA-pchr-8j38-3x4p	Dependencies (osv-scanner)
high	`osv/GHSA-phj9-mv4w-65pm`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2256, GHSA-phj9-mv4w-65pm	Dependencies (osv-scanner)
high	`osv/GHSA-pwv6-vv43-88gr`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2252, GHSA-pwv6-vv43-88gr	Dependencies (osv-scanner)
high	`osv/GHSA-q45j-58j2-45rg`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-q45j-58j2-45rg	Dependencies (osv-scanner)
high	`osv/GHSA-vjc4-5qp5-m44j`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-3496, GHSA-vjc4-5qp5-m44j	Dependencies (osv-scanner)
high	`osv/GHSA-whj4-6x5x-4v2j`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2250, GHSA-whj4-6x5x-4v2j	Dependencies (osv-scanner)
high	`osv/GHSA-xcvg-w56q-r89m`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-xcvg-w56q-r89m	Dependencies (osv-scanner)
high	`osv/GHSA-xgh8-jp6q-p5x8`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4335, GHSA-xgh8-jp6q-p5x8	Dependencies (osv-scanner)
high	`osv/GHSA-xj96-63gp-2gmr`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-3454, GHSA-xj96-63gp-2gmr	Dependencies (osv-scanner)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	web/launch-check/scan.py:255	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/dockerfile.security.missing-user`	workspaces/ledger/Dockerfile:9	By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile...	Static analysis (opengrep)
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	forge/traceability.py:107	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	plugins/agent-forge/skills/spec-trace-gate/scripts/trace_gate.py:107	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	skills/spec-trace-gate/scripts/trace_gate.py:107	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.maintainability.return-not-in-function`	web/launch-check/app.py:60	`return` only makes sense inside a function	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	web/launch-check/app.py:709	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.maintainability.return-not-in-function`	web/launch-check/fixpack.py:75	`return` only makes sense inside a function	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	web/launch-check/fixpages.py:107	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	web/launch-check/fixpages.py:111	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	web/launch-check/fixpages.py:118	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.maintainability.return-not-in-function`	web/launch-check/fixpages.py:13	`return` only makes sense inside a function	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	web/launch-check/guard.py:48	Is "is_private" a function or an attribute? If it is a function, you may have meant ip.is_private() because ip.is_private is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	web/launch-check/guard.py:48	Is "is_loopback" a function or an attribute? If it is a function, you may have meant ip.is_loopback() because ip.is_loopback is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	web/launch-check/guard.py:48	Is "is_link_local" a function or an attribute? If it is a function, you may have meant ip.is_link_local() because ip.is_link_local is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	web/launch-check/guard.py:48	Is "is_multicast" a function or an attribute? If it is a function, you may have meant ip.is_multicast() because ip.is_multicast is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	web/launch-check/guard.py:48	Is "is_reserved" a function or an attribute? If it is a function, you may have meant ip.is_reserved() because ip.is_reserved is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	web/launch-check/guard.py:49	Is "is_unspecified" a function or an attribute? If it is a function, you may have meant ip.is_unspecified() because ip.is_unspecified is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	web/launch-check/guard.py:49	Is "is_global" a function or an attribute? If it is a function, you may have meant ip.is_global() because ip.is_global is always true.	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	web/launch-check/ogmaker.py:538	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	web/launch-check/ogmaker.py:540	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`zizmor/excessive-permissions`	.github/workflows/ci.yml:1	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/ci.yml:16	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/ci.yml:33	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/ci.yml:37	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/ci.yml:58	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/ci.yml:62	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/ci.yml:9	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`opengrep/python.lang.security.insecure-hash-algorithm-sha1`	plugins/agent-forge/skills/launch-check/scripts/polish_audit.py:1059	Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	plugins/agent-forge/skills/launch-check/scripts/polish_audit.py:699	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	plugins/agent-forge/skills/launch-check/scripts/polish_audit.py:713	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.insecure-hash-algorithm-sha1`	plugins/launch-check/skills/launch-check/scripts/polish_audit.py:1059	Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	plugins/launch-check/skills/launch-check/scripts/polish_audit.py:699	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	plugins/launch-check/skills/launch-check/scripts/polish_audit.py:713	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.insecure-hash-algorithm-sha1`	skills/launch-check/scripts/polish_audit.py:1059	Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	skills/launch-check/scripts/polish_audit.py:699	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	skills/launch-check/scripts/polish_audit.py:713	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	web/launch-check/app.py:276	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	web/launch-check/fixpack.py:390	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	web/launch-check/fixpack.py:421	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.regex_dos`	web/launch-check/ogmaker.py:42	Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2....	Static analysis (opengrep)
medium	`osv/GHSA-24rc-8hj2-v98c`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-24rc-8hj2-v98c	Dependencies (osv-scanner)
medium	`osv/GHSA-254f-3936-288h`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-254f-3936-288h	Dependencies (osv-scanner)
medium	`osv/GHSA-462x-pgg6-55fp`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-462x-pgg6-55fp	Dependencies (osv-scanner)
medium	`osv/GHSA-4rm8-3hmm-39fg`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4340, GHSA-4rm8-3hmm-39fg	Dependencies (osv-scanner)
medium	`osv/GHSA-4x4j-2g7c-83w6`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2257, GHSA-4x4j-2g7c-83w6	Dependencies (osv-scanner)
medium	`osv/GHSA-74r2-7ff9-mjj2`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-74r2-7ff9-mjj2	Dependencies (osv-scanner)
medium	`osv/GHSA-fc9g-5qg7-mf45`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-fc9g-5qg7-mf45	Dependencies (osv-scanner)
medium	`osv/GHSA-fj7v-r99m-22gq`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-3494, GHSA-fj7v-r99m-22gq	Dependencies (osv-scanner)
medium	`osv/GHSA-p8hx-v2p6-rp84`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4337, GHSA-p8hx-v2p6-rp84	Dependencies (osv-scanner)
medium	`osv/GHSA-r73j-pqj5-w3x7`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2874, GHSA-r73j-pqj5-w3x7	Dependencies (osv-scanner)
medium	`osv/GHSA-rfgq-q3w2-pmv2`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-rfgq-q3w2-pmv2	Dependencies (osv-scanner)
medium	`osv/GHSA-vx6w-vv9f-6gvg`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-vx6w-vv9f-6gvg	Dependencies (osv-scanner)
medium	`osv/GHSA-wjx4-4jcj-g98j`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-165, GHSA-wjx4-4jcj-g98j	Dependencies (osv-scanner)
medium	`osv/GHSA-wqgw-9xfh-qf2g`	web/launch-check/requirements.txt	[email protected] (PyPI) is affected by GHSA-wqgw-9xfh-qf2g	Dependencies (osv-scanner)
medium	`opengrep/python.lang.security.audit.non-literal-import`	web/launch-check/run_guarded.py:472	Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. [confidence low]	Static analysis (opengrep)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	skipped	`—`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-4`	0
Findings in AI-written lines	AI provenance	ok	`git-blame`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	22
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	ok	`—`	0
CI workflows (zizmor)	Security	ok	`zizmor 1.32.0`	13
Dependencies (osv-scanner)	Security	ok	`osv-scanner version: 2.7.1`	54
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	ok	`—`	0
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	17
OpenSSF Scorecard	Security	skipped	`—`	0	no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	0

Score history

Scores from different scoring versions aren't directly comparable.

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`20bf7ef688c3`	`prov-5+qual-2+sec-2`	8%	54	69
2026-11-14	`20bf7ef688c3`	`prov-4+qual-2+sec-2`	8%	54	69

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/Ces107/agent-forge/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/Ces107/agent-forge/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/Ces107/agent-forge/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/Ces107/agent-forge/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/Ces107/agent-forge/security.svg)](https://repotrust.synapticcyber.com/r/github.com/Ces107/agent-forge/)

Full text report

Repository: https://github.com/Ces107/agent-forge
Commit: 20bf7ef688c37257e8ed4ed22ad6331f738c4516
Generated: 2026-11-14T14:52:00+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	8	explicit	95%	100%
Code quality	54	weak	90%	100%
Security	69	weak	85%	100%

AI provenance

Explicit AI attribution on 8% of first-party code added; an estimated 8% including velocity signals.

Explicitly attributed share (lower bound): 7.8%
Unattributed share in AI-consistent velocity bursts: 76.9%
Estimated AI-generated share: 7.8%

AI tool	Attributed commits	Lines added
Claude Code	5	2,404

AI tooling configured in repo: claude-code

Current source lines last changed by AI-attributed commits: 663 of 25,784.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Quality	1.508	0.836	1.8x
Security	0.0	0.637	0.0x

Stylometry index: 0.04 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 2). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2026-06	4,488	54%
2026-10	26,174	0%

Evidence

Claude Code: trailer 'Co-Authored-By: Claude' (998e7f464362)
Claude Code: trailer 'Co-Authored-By: Claude' (49fa17691aff)
Claude Code: trailer 'Co-Authored-By: Claude' (708ee99541d9)
Claude Code: trailer 'Co-Authored-By: Claude' (443bbbd6ce99)
Claude Code: trailer 'Co-Authored-By: Claude' (852469136b2e)
6,672 lines of first-party code in ~2.1h (3,196 lines/hour, 10 commit session) (4aef0e4f0d46)
12,438 lines of first-party code in ~4.8h (2,603 lines/hour, 28 commit session) (1f3a73700fd5)
.claude/agents/adversarial-reviewer.md (claude-code configuration) (.claude/agen)
.claude/agents/architect.md (claude-code configuration) (.claude/agen)
.claude/agents/implementer.md (claude-code configuration) (.claude/agen)
.claude/agents/planner.md (claude-code configuration) (.claude/agen)
.claude/agents/verifier.md (claude-code configuration) (.claude/agen)
2,564 lines of first-party code in ~2.0h (1,262 lines/hour, 2 commit session) (d30263d5df6a)
1,892 lines of first-party code in ~2.9h (661 lines/hour, 4 commit session) (f582c44182a5)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.14, CI runs tests; 49% of function code in complex or long functions; 68% duplicated lines. Weakest area: duplication.

Area	Score
Complexity (lizard)	23
Duplication	2
Code smells (Opengrep)	76
Tests and CI	82
Documentation	65
Type safety	100
Process (Scorecard review/maintenance)	n/a

Functions: 917; mean complexity 8.7, 90th percentile 18; 121 complex and 14 long functions
Duplicated lines: 67.7% of 21,632 compared
Tests: 3,691 test lines for 25,784 source lines (ratio 0.14); CI test commands: pytest; 39% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is weak: 54 known vulnerabilities in 1 dependencies; 3 high-severity SAST findings; 6 high-severity workflow issues. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	90
Vulnerable dependencies (OSV)	78
CI workflows (zizmor)	24
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Known vulnerabilities: 54 in 1 packages (critical 5, high 35, medium 13, low 0)
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity	Finding	Location
critical	`osv/GHSA-5x8w-8jj5-q52h`: [email protected] (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h	web/launch-check/requirements.txt
critical	`osv/GHSA-8g5g-8vmr-9782`: [email protected] (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782	web/launch-check/requirements.txt
critical	`osv/GHSA-xvh5-g6gv-559v`: [email protected] (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v	web/launch-check/requirements.txt
critical	`osv/GHSA-332p-7hrc-92wf`: [email protected] (PyPI) is affected by GHSA-332p-7hrc-92wf	web/launch-check/requirements.txt
critical	`osv/GHSA-w889-685w-c8fh`: [email protected] (PyPI) is affected by GHSA-w889-685w-c8fh	web/launch-check/requirements.txt
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	forge/orchestrator.py:124
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	web/launch-check/scan.py:255
high	`opengrep/dockerfile.security.missing-user`: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]	workspaces/ledger/Dockerfile:9
high	`osv/GHSA-cfh3-3jmp-rvhc`: [email protected] (PyPI) is affected by PYSEC-2026-2249, GHSA-cfh3-3jmp-rvhc	web/launch-check/requirements.txt
high	`osv/GHSA-whj4-6x5x-4v2j`: [email protected] (PyPI) is affected by PYSEC-2026-2250, GHSA-whj4-6x5x-4v2j	web/launch-check/requirements.txt
high	`osv/GHSA-pwv6-vv43-88gr`: [email protected] (PyPI) is affected by PYSEC-2026-2252, GHSA-pwv6-vv43-88gr	web/launch-check/requirements.txt
high	`osv/GHSA-8v84-f9pq-wr9x`: [email protected] (PyPI) is affected by PYSEC-2026-2253, GHSA-8v84-f9pq-wr9x	web/launch-check/requirements.txt
high	`osv/GHSA-5x94-69rx-g8h2`: [email protected] (PyPI) is affected by PYSEC-2026-2254, GHSA-5x94-69rx-g8h2	web/launch-check/requirements.txt
high	`osv/GHSA-45hq-cxwh-f6vc`: [email protected] (PyPI) is affected by PYSEC-2026-2255, GHSA-45hq-cxwh-f6vc	web/launch-check/requirements.txt
high	`osv/GHSA-phj9-mv4w-65pm`: [email protected] (PyPI) is affected by PYSEC-2026-2256, GHSA-phj9-mv4w-65pm	web/launch-check/requirements.txt
high	`osv/GHSA-6r8x-57c9-28j4`: [email protected] (PyPI) is affected by PYSEC-2026-3451, GHSA-6r8x-57c9-28j4	web/launch-check/requirements.txt
high	`osv/GHSA-9hw9-ch79-4vh6`: [email protected] (PyPI) is affected by PYSEC-2026-3453, GHSA-9hw9-ch79-4vh6	web/launch-check/requirements.txt
high	`osv/GHSA-xj96-63gp-2gmr`: [email protected] (PyPI) is affected by PYSEC-2026-3454, GHSA-xj96-63gp-2gmr	web/launch-check/requirements.txt
high	`osv/GHSA-62p4-gmf7-7g93`: [email protected] (PyPI) is affected by PYSEC-2026-3493, GHSA-62p4-gmf7-7g93	web/launch-check/requirements.txt
high	`osv/GHSA-jjj6-mw9f-p565`: [email protected] (PyPI) is affected by PYSEC-2026-3495, GHSA-jjj6-mw9f-p565	web/launch-check/requirements.txt
high	`osv/GHSA-vjc4-5qp5-m44j`: [email protected] (PyPI) is affected by PYSEC-2026-3496, GHSA-vjc4-5qp5-m44j	web/launch-check/requirements.txt
high	`osv/GHSA-27h8-gf7j-v5hc`: [email protected] (PyPI) is affected by PYSEC-2026-4326, GHSA-27h8-gf7j-v5hc	web/launch-check/requirements.txt
high	`osv/GHSA-4558-3h8r-v8xp`: [email protected] (PyPI) is affected by PYSEC-2026-4327, GHSA-4558-3h8r-v8xp	web/launch-check/requirements.txt
high	`osv/GHSA-58r4-6rv3-gfh8`: [email protected] (PyPI) is affected by PYSEC-2026-4329, GHSA-58r4-6rv3-gfh8	web/launch-check/requirements.txt
high	`osv/GHSA-7mwm-ghpf-9vrm`: [email protected] (PyPI) is affected by PYSEC-2026-4331, GHSA-7mwm-ghpf-9vrm	web/launch-check/requirements.txt

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 25,784; test lines: 3,691

Language	Lines
Python	29,475