RepoTrust

Leaderboard github.com

GerritKruse/obsidian-citation-links

Render Obsidian wikilinks to citekeys as formatted citations.

  • View repository ↗
  • TypeScript
  • ★ 2
  • commit 3432c1ab6272
  • scored 2026-11-14
  • scoring prov-5+qual-2+sec-2

AI provenance

100%

explicit

Confidence
75%
Coverage
100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

92/100

strong

Confidence
90%
Coverage
100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

64/100

weak

Confidence
85%
Coverage
100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

AI provenance

100% explicit

Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals.

How the score is built

  • Explicitly attributed share100%
  • Unattributed share in AI-pace bursts0%
  • Estimated AI-generated share100%
  • AI tool configuration files1
  • Work sessions at AI pace0
  • Releases at AI pace0
  • Coding-style index (1.0+ means possible)0.00

Attributed AI tools

ToolCommitsLines addedFirst seenLast seen
Claude Code196,2462026-09-162026-10-29

Lines added per month all AI-attributed share

  1. 2026-095,341 · 100% AI
  2. 2026-10905 · 100% AI

Findings in AI-attributed lines vs the rest

From git blame: 3,993 lines trace to AI-attributed commits, 0 to others. Too few lines in one group for a fair comparison. Reported, not scored.

Findings per 1,000 linesAI-attributedOtherRatio
Code quality0.00——
Security2.25——

Evidence by analyzer

Explicit AI attributionok20 items
attributed_commit_share
95.0%
attributed_commits
19
attributed_loc
6,246
attributed_loc_share
100.0%
commits
20
effective_loc
6,246
tools_detected
1
AI tool configurationok1 item
artifacts
1
earliest_adoption
2026-09-16
tools_configured
1
workflow_agents
0
Commit velocityok
excluded_import_loc
2,489
flagged_loc
0
flagged_loc_share
0.0%
flagged_units
0
max_loc_per_hour
341.50
measured_loc
3,757
median_loc_per_hour
219.24
pr_timed_units
0
pre_ai_era_burst_loc
0
pre_ai_era_bursts
0
pre_ai_era_measured_loc
0
work_units
6
Release velocityok
flagged_releases
0
max_loc_per_day
2,295.40
releases
3
Coding styleok
count:assistant_voice
0
count:emoji_in_code
0
count:narrated_steps
0
count:placeholder
0
files:assistant_voice
0
files:emoji_in_code
0
files:narrated_steps
0
files:placeholder
0
index
0
lines_scanned
3,993
per_kloc:assistant_voice
0
per_kloc:emoji_in_code
0
per_kloc:narrated_steps
0
per_kloc:placeholder
0
Findings in AI-written linesok
ai_lines
3,993
blame_failures
0
files_blamed
33
other_lines
0
quality:ai_findings
0
quality:ai_per_kloc
0
quality:other_findings
0
security:ai_findings
9
security:ai_per_kloc
2.25
security:other_findings
0

Code quality

92 strong

Code quality is strong: test-to-source ratio 0.50, CI runs tests; 1% of function code in complex or long functions; 0% duplicated lines. Weakest area: docs.

How the score is built

  • Complexity96
  • Duplication100
  • Lint and smells100
  • Tests and CI90
  • Documentation65
  • Type safety100
  • Review processnot measured

Evidence by analyzer

Complexity (lizard)ok1 item
complex_functions
1
function_nloc
2,344
functions
263
long_functions
0
many_param_functions
0
mean_ccn
2.69
p90_ccn
6
risky_nloc_share
1.4%
Duplication (jscpd)ok
compared_lines
2,734
duplicated_lines
0
duplicated_share
0.0%
files
33
Lintok
findings
0
scanned_lines
3,993
weighted_findings
0
Tests and CIok3 items
  • CI config: .github/workflows/lint.yml .github/workflows/lint.yml
  • CI config: .github/workflows/release.yml .github/workflows/release.yml
  • CI runs tests (npm test, vitest)
check:ci_present
yes
check:ci_runs_lint
no
check:ci_runs_tests
yes
check:has_tests
yes
check:test_ratio
no
check:tests_cochange
yes
ci_files
2
cochange_commits
11
cochange_share
63.6%
source_lines
3,993
test_lines
1,981
test_ratio
0.50
Documentationok2 items
  • README.md README.md
  • LICENSE LICENSE
check:changelog
no
check:contributing
no
check:license
yes
check:readme
yes
readme_lines
164
Type safetyok1 item
  • TypeScript strict type checking: tsconfig.json tsconfig.json
check:low_escape_density
yes
check:strict_config
yes
escapes
0
escapes_per_kloc
0

Security

64 weak

Security posture is weak: 17 known vulnerabilities in 8 dependencies; 6 high-severity workflow issues. Weakest area: posture.

How the score is built

  • Secrets90
  • Static analysis (SAST)95
  • Vulnerable dependencies57
  • CI workflows33
  • Security posture0
  • OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok
checked
16
declared
16
lookup_errors
0
missing
0
recent
0
Secrets (gitleaks)ok
secrets_current
0
secrets_history
0
secrets_low_confidence
0
secrets_nonprod
3
Static analysis (opengrep)ok
findings
9
findings_high
0
findings_low
9
findings_medium
0
parse_errors
0
scanned_lines
3,993
weighted_findings
0.56
Dependencies (osv-scanner)ok
penalty
34
vulnerabilities
17
vulnerable_packages
8
vulns_critical
0
vulns_high
2
vulns_low
3
vulns_medium
12
vulns_unknown
0
CI workflows (zizmor)ok
findings
9
findings_high
6
findings_low
2
findings_medium
1
penalty
66.60
workflows
2
Security postureok
check:dependency_updates
no
check:lockfiles
yes
check:security_policy
no
check:signed_commits
no
signed_commit_share
5.0%
unpinned_manifests
0
Release downloadsok
binary_assets
0
signals
0
suspicious
0

Findings

8 high13 medium17 low

SeverityRuleLocationMessageTool
high zizmor/unpinned-uses .github/workflows/lint.yml:20 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/lint.yml:22 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/release.yml:16 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/cache-poisoning .github/workflows/release.yml:19 runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/release.yml:19 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/release.yml:36 unpinned action reference [confidence high] CI workflows (zizmor)
high osv/GHSA-587h-7wmj-h5pm package-lock.json [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm Dependencies (osv-scanner)
high osv/GHSA-68fv-2mgg-jv7q package-lock.json [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q Dependencies (osv-scanner)
medium zizmor/excessive-permissions .github/workflows/lint.yml:10 overly broad permissions [confidence medium] CI workflows (zizmor)
medium osv/GHSA-4p3w-j4w9-5jqw package-lock.json [email protected] (npm) is affected by GHSA-4p3w-j4w9-5jqw Dependencies (osv-scanner)
medium osv/GHSA-698v-4r3x-3vcv package-lock.json [email protected] (npm) is affected by GHSA-698v-4r3x-3vcv Dependencies (osv-scanner)
medium osv/GHSA-g3hv-75wg-m249 package-lock.json [email protected] (npm) is affected by GHSA-g3hv-75wg-m249 Dependencies (osv-scanner)
medium osv/GHSA-g3hv-75wg-m249 package-lock.json [email protected] (npm) is affected by GHSA-g3hv-75wg-m249 Dependencies (osv-scanner)
medium osv/GHSA-g3hv-75wg-m249 package-lock.json [email protected] (npm) is affected by GHSA-g3hv-75wg-m249 Dependencies (osv-scanner)
medium osv/GHSA-qxg6-89mg-rqv8 package-lock.json @vitest/[email protected] (npm) is affected by GHSA-qxg6-89mg-rqv8 Dependencies (osv-scanner)
medium osv/GHSA-r825-w8mm-5pxw package-lock.json [email protected] (npm) is affected by GHSA-r825-w8mm-5pxw Dependencies (osv-scanner)
medium osv/GHSA-rq7h-c2jc-7f22 package-lock.json [email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22 Dependencies (osv-scanner)
medium osv/GHSA-vfpm-58rq-9qcg package-lock.json [email protected] (npm) is affected by GHSA-vfpm-58rq-9qcg Dependencies (osv-scanner)
medium osv/GHSA-w74x-v6f9-j3xg package-lock.json [email protected] (npm) is affected by GHSA-w74x-v6f9-j3xg Dependencies (osv-scanner)
medium osv/GHSA-wjr9-j795-jxcr package-lock.json [email protected] (npm) is affected by GHSA-wjr9-j795-jxcr Dependencies (osv-scanner)
medium osv/GHSA-xp26-3454-mjgp package-lock.json @vitest/[email protected] (npm) is affected by GHSA-xp26-3454-mjgp Dependencies (osv-scanner)
low zizmor/artipacked .github/workflows/lint.yml:20 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/release.yml:16 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low osv/GHSA-333x-w4r6-6crp package-lock.json [email protected] (npm) is affected by GHSA-333x-w4r6-6crp Dependencies (osv-scanner)
low osv/GHSA-9jrq-w75r-8gcw package-lock.json [email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw Dependencies (osv-scanner)
low osv/GHSA-xhq7-xmqj-769h package-lock.json [email protected] (npm) is affected by GHSA-xhq7-xmqj-769h Dependencies (osv-scanner)
low opengrep/javascript.lang.security.audit.unsafe-formatstring src/bibliography/index.ts:198 Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... Static analysis (opengrep)
low opengrep/javascript.lang.security.audit.unsafe-formatstring src/bibliography/index.ts:218 Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... Static analysis (opengrep)
low opengrep/javascript.lang.security.audit.unsafe-formatstring src/bibliography/index.ts:251 Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... Static analysis (opengrep)
low opengrep/javascript.lang.security.audit.unsafe-formatstring src/bibliography/index.ts:280 Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... Static analysis (opengrep)
low opengrep/javascript.lang.security.audit.unsafe-formatstring src/bibliography/index.ts:292 Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... Static analysis (opengrep)
low opengrep/javascript.lang.security.audit.unsafe-formatstring src/bibliography/loader.ts:149 Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... Static analysis (opengrep)
low opengrep/javascript.lang.security.audit.unsafe-formatstring src/bibliography/loader.ts:162 Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... Static analysis (opengrep)
low opengrep/javascript.lang.security.audit.unsafe-formatstring src/notes.ts:64 Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... Static analysis (opengrep)
low gitleaks/generic-api-key src/parser/link.test.ts:7 Possible generic-api-key secret in the current tree (test/docs/example file) Secrets (gitleaks)
low gitleaks/generic-api-key src/render/formatter.test.ts:53 Possible generic-api-key secret in the current tree (test/docs/example file) Secrets (gitleaks)
low opengrep/javascript.lang.security.audit.unsafe-formatstring src/render/formatter.ts:176 Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... Static analysis (opengrep)
low gitleaks/generic-api-key test/fixtures/bibliography.json:22 Possible generic-api-key secret in the current tree (test/docs/example file) Secrets (gitleaks)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

AnalyzerPillarStatusVersionFindingsNote
AI tool configurationAI provenanceoksignatures-v10
Explicit AI attributionAI provenanceoksignatures-v10
Release velocityAI provenanceokprov-40
Coding styleAI provenanceok—0
Commit velocityAI provenanceokprov-40
Findings in AI-written linesAI provenanceokgit-blame0
Complexity (lizard)Code qualityoklizard 1.25.10
DocumentationCode qualityok—0
Duplication (jscpd)Code qualityokrepotrust-dup-w60
LintCode qualityokopengrep 1.33.1; rules f1d2b562b4140
Tests and CICode qualityok—0
Type safetyCode qualityok—0
CI workflows (zizmor)Securityokzizmor 1.32.09
Dependencies (osv-scanner)Securityokosv-scanner version: 2.7.117
Release downloadsSecurityok—0
Security postureSecurityok—0
Package registriesSecurityok—0
Static analysis (opengrep)Securityokopengrep 1.33.1; rules f1d2b562b4149
OpenSSF ScorecardSecurityskipped—0no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)Securityokgitleaks 8.30.13

Score history

Scores from different scoring versions aren't directly comparable.

ScoredCommitScoringAI provenanceQualitySecurity
2026-11-143432c1ab6272prov-5+qual-2+sec-2100%9264
2026-11-143432c1ab6272prov-4+qual-2+sec-2100%9264

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/GerritKruse/obsidian-citation-links/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/GerritKruse/obsidian-citation-links/)
[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/GerritKruse/obsidian-citation-links/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/GerritKruse/obsidian-citation-links/)
[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/GerritKruse/obsidian-citation-links/security.svg)](https://repotrust.synapticcyber.com/r/github.com/GerritKruse/obsidian-citation-links/)
Full text report

Scores

Pillar Score Signal Confidence Coverage
AI provenance (estimated AI-generated share) 100 explicit 75% 100%
Code quality 92 strong 90% 100%
Security 64 weak 85% 100%

AI provenance

Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals.

  • Explicitly attributed share (lower bound): 100.0%
  • Unattributed share in AI-consistent velocity bursts: 0.0%
  • Estimated AI-generated share: 100.0%
AI tool Attributed commits Lines added
Claude Code 19 6,246
  • AI tooling configured in repo: generic-agent

Current source lines last changed by AI-attributed commits: 3,993 of 3,993.

Too few lines in one group to compare finding densities.

Month Lines added Attributed to AI
2026-09 5,341 100%
2026-10 905 100%

Evidence

  • Claude Code: trailer 'Co-Authored-By: Claude' (3432c1ab6272)
  • Claude Code: trailer 'Co-Authored-By: Claude' (9cff01256f43)
  • Claude Code: trailer 'Co-Authored-By: Claude' (2bb1916004dd)
  • Claude Code: trailer 'Co-Authored-By: Claude' (de857c6ab0b8)
  • Claude Code: trailer 'Co-Authored-By: Claude' (65c1c825d7bd)
  • Claude Code: trailer 'Co-Authored-By: Claude' (f71e6a18cc8c)
  • Claude Code: trailer 'Co-Authored-By: Claude' (ebaf640582dc)
  • Claude Code: trailer 'Co-Authored-By: Claude' (4b353a670b9e)
  • Claude Code: trailer 'Co-Authored-By: Claude' (68cd0f1ba6c2)
  • Claude Code: trailer 'Co-Authored-By: Claude' (c2d88da84c58)
  • Claude Code: trailer 'Co-Authored-By: Claude' (fa0c05907527)
  • Claude Code: trailer 'Co-Authored-By: Claude' (fc3608b7261e)
  • Claude Code: trailer 'Co-Authored-By: Claude' (7e3387bf0293)
  • Claude Code: trailer 'Co-Authored-By: Claude' (4ee4d59f902d)
  • Claude Code: trailer 'Co-Authored-By: Claude' (65c0ec4e9f93)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is strong: test-to-source ratio 0.50, CI runs tests; 1% of function code in complex or long functions; 0% duplicated lines. Weakest area: docs.

Area Score
Complexity (lizard) 96
Duplication 100
Code smells (Opengrep) 100
Tests and CI 90
Documentation 65
Type safety 100
Process (Scorecard review/maintenance) n/a
  • Functions: 263; mean complexity 2.7, 90th percentile 6; 1 complex and 0 long functions
  • Duplicated lines: 0.0% of 2,734 compared
  • Tests: 1,981 test lines for 3,993 source lines (ratio 0.50); CI test commands: npm test, vitest; 64% of recent source commits also change tests
  • Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is weak: 17 known vulnerabilities in 8 dependencies; 6 high-severity workflow issues. Weakest area: posture.

Area Score
Secrets (gitleaks, tree + history) 90
Static analysis (Opengrep) 95
Vulnerable dependencies (OSV) 57
CI workflows (zizmor) 33
Posture (policy, updates, signing, lockfiles) 0
OpenSSF Scorecard n/a
  • Known vulnerabilities: 17 in 8 packages (critical 0, high 2, medium 12, low 3)

  • Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity Finding Location
high osv/GHSA-68fv-2mgg-jv7q: [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q package-lock.json
high osv/GHSA-587h-7wmj-h5pm: [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm package-lock.json
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/lint.yml:20
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/lint.yml:22
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/release.yml:16
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/release.yml:19
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/release.yml:36
high zizmor/cache-poisoning: runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] .github/workflows/release.yml:19
medium osv/GHSA-qxg6-89mg-rqv8: @vitest/[email protected] (npm) is affected by GHSA-qxg6-89mg-rqv8 package-lock.json
medium osv/GHSA-xp26-3454-mjgp: @vitest/[email protected] (npm) is affected by GHSA-xp26-3454-mjgp package-lock.json
medium osv/GHSA-w74x-v6f9-j3xg: [email protected] (npm) is affected by GHSA-w74x-v6f9-j3xg package-lock.json
medium osv/GHSA-wjr9-j795-jxcr: [email protected] (npm) is affected by GHSA-wjr9-j795-jxcr package-lock.json
medium osv/GHSA-g3hv-75wg-m249: [email protected] (npm) is affected by GHSA-g3hv-75wg-m249 package-lock.json
medium osv/GHSA-g3hv-75wg-m249: [email protected] (npm) is affected by GHSA-g3hv-75wg-m249 package-lock.json
medium osv/GHSA-g3hv-75wg-m249: [email protected] (npm) is affected by GHSA-g3hv-75wg-m249 package-lock.json
medium osv/GHSA-4p3w-j4w9-5jqw: [email protected] (npm) is affected by GHSA-4p3w-j4w9-5jqw package-lock.json
medium osv/GHSA-698v-4r3x-3vcv: [email protected] (npm) is affected by GHSA-698v-4r3x-3vcv package-lock.json
medium osv/GHSA-r825-w8mm-5pxw: [email protected] (npm) is affected by GHSA-r825-w8mm-5pxw package-lock.json
medium osv/GHSA-rq7h-c2jc-7f22: [email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22 package-lock.json
medium osv/GHSA-vfpm-58rq-9qcg: [email protected] (npm) is affected by GHSA-vfpm-58rq-9qcg package-lock.json
medium zizmor/excessive-permissions: overly broad permissions [confidence medium] .github/workflows/lint.yml:10
low gitleaks/generic-api-key: Possible generic-api-key secret in the current tree (test/docs/example file) src/parser/link.test.ts:7
low gitleaks/generic-api-key: Possible generic-api-key secret in the current tree (test/docs/example file) test/fixtures/bibliography.json:22
low gitleaks/generic-api-key: Possible generic-api-key secret in the current tree (test/docs/example file) src/render/formatter.test.ts:53
low opengrep/javascript.lang.security.audit.unsafe-formatstring: Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low] src/bibliography/index.ts:198

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

  • Source lines: 3,993; test lines: 1,981
Language Lines
TypeScript 5,903
JavaScript 71