CoderLuii/HolyClaude
AI coding workstation: Claude Code + web UI + 8 AI CLIs + headless browser + 50+ tools
- Repository: https://github.com/CoderLuii/HolyClaude
- Commit:
c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908 - Generated: 2026-11-14T00:04:31+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | possible | 56% | 100% |
| Code quality | 69 | adequate | 90% | 100% |
| Security | 83 | adequate | 85% | 100% |
AI provenance
Weak signals consistent with AI-assisted development.
- Explicitly attributed share (lower bound): 0.0%
- Unattributed share in AI-consistent velocity bursts: 37.0%
- Estimated AI-generated share: 0.0%
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-03 | 360 | 0% |
| 2026-05 | 446 | 0% |
| 2026-06 | 2,106 | 0% |
| 2026-07 | 10,379 | 0% |
| 2026-08 | 1,801 | 0% |
| 2026-09 | 15,563 | 0% |
| 2026-10 | 6,072 | 0% |
| 2026-11 | 1,660 | 0% |
Evidence
- 2,986 lines of first-party code in ~4.0h (746 lines/hour, 1 commit session) (60972094fa12)
- 2,425 lines of first-party code in ~4.0h (606 lines/hour, 1 commit session) (933682705791)
- 2,326 lines of first-party code in ~4.0h (582 lines/hour, 1 commit session) (e10b9ff22071)
- 2,218 lines of first-party code in ~4.0h (554 lines/hour, 1 commit session) (183f2a913c76)
- 2,198 lines of first-party code in ~4.0h (550 lines/hour, 1 commit session) (4c1bd9a109e2)
- 2,050 lines of first-party code in ~4.0h (512 lines/hour, 1 commit session) (20e9e10681ae)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 2.40, CI runs tests; 37% of function code in complex or long functions; 4% duplicated lines. Weakest area: complexity.
| Area | Score |
|---|---|
| Complexity (lizard) | 33 |
| Duplication | 79 |
| Code smells (Opengrep) | 62 |
| Tests and CI | 90 |
| Documentation | 100 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 502; mean complexity 4.9, 90th percentile 11; 32 complex and 5 long functions
- Duplicated lines: 4.0% of 6,663 compared
- Tests: 21,631 test lines for 9,027 source lines (ratio 2.40); CI test commands: unittest; 71% of recent source commits also change tests
- Docs missing or thin: none
Most complex functions:
- validateLocalReleaseEvidence in scripts/verify-local-release-evidence.mjs: complexity 78, 71 lines
- validateLocalDockerIsolation in scripts/verify-local-docker-isolation.mjs: complexity 56, 31 lines
- validateAuthorityEvidence in scripts/evaluate-security-report.mjs: complexity 51, 128 lines
- validateReview in scripts/evaluate-security-report.mjs: complexity 47, 84 lines
- validateSyftEvidence in scripts/evaluate-upstream-dependency-report.mjs: complexity 46, 59 lines
Security
Security posture is adequate: 1 high-severity SAST findings. Weakest area: sast.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 97 |
| Static analysis (Opengrep) | 63 |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | 88 |
| Posture (policy, updates, signing, lockfiles) | 80 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: security policy, dependency updates, lockfiles; missing: signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/dockerfile.security.last-user-is-root: The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'. [confidence medium] |
Dockerfile:531 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp: RegExp() called with a pattern function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low] |
scripts/evaluate-security-report.mjs:392 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp: RegExp() called with a pattern function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low] |
scripts/evaluate-security-report.mjs:401 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp: RegExp() called with a review function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll [confidence low] |
scripts/evaluate-security-report.mjs:496 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp: RegExp() called with a key function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low] |
scripts/evaluate-upstream-dependency-report.mjs:259 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename: Detected that function argument target has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low] |
scripts/patch-cloudcli-apprise-notifications.mjs:106 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename: Detected that function argument target has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low] |
scripts/patch-cloudcli-apprise-notifications.mjs:118 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename: Detected that function argument target has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low] |
scripts/patch-cloudcli-apprise-notifications.mjs:183 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename: Detected that function argument filePath has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low] |
scripts/patch-cloudcli-base-path.mjs:239 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename: Detected that function argument filePath has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low] |
scripts/patch-cloudcli-base-path.mjs:247 |
| medium | opengrep/javascript.lang.security.audit.unknown-value-with-script-tag: Cannot determine what 'source' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'source' is not externally controlled, or sanitize this data. [confidence low] |
scripts/patch-cloudcli-base-path.mjs:294 |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal: Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low] |
scripts/patch-cloudcli-base-path.mjs:348 |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal: Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low] |
scripts/patch-cloudcli-base-path.mjs:349 |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal: Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low] |
scripts/patch-cloudcli-base-path.mjs:350 |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal: Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low] |
scripts/patch-cloudcli-base-path.mjs:351 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename: Detected that function argument packageRoot has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low] |
scripts/patch-cloudcli-base-path.mjs:353 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename: Detected that function argument packageRoot has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low] |
scripts/patch-cloudcli-base-path.mjs:353 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename: Detected that function argument packageRoot has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low] |
scripts/patch-cloudcli-base-path.mjs:353 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename: Detected that function argument packageRoot has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low] |
scripts/patch-cloudcli-base-path.mjs:353 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename: Detected that function argument packageRoot has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low] |
scripts/patch-cloudcli-base-path.mjs:360 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename: Detected that function argument packageRoot has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low] |
scripts/patch-cloudcli-base-path.mjs:361 |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal: Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low] |
scripts/patch-cloudcli-base-path.mjs:371 |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal: Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low] |
scripts/patch-cloudcli-base-path.mjs:371 |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal: Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low] |
scripts/patch-cloudcli-base-path.mjs:375 |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal: Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low] |
scripts/patch-cloudcli-base-path.mjs:375 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- readme-download-lure: gives an archive password
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 9,027; test lines: 21,631
| Language | Lines |
|---|---|
| JavaScript | 22,664 |
| Shell | 6,189 |
| Python | 1,805 |