alchaincyf/huashu-motion

让你的agent一键直出商业级产品宣传片：会作曲，能指着画面改。Commercial-grade launch films by your coding agent — point at the frame to change it.

https://github.com/alchaincyf/huashu-motion · commit 0272906902c3 · scored 2026-11-14 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/alchaincyf/huashu-motion
Commit: 0272906902c33c796a81637545905ea7f2b81c5a
Generated: 2026-11-14T00:00:39+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	100	explicit	74%	100%
Code quality	61	weak	90%	100%
Security	63	weak	85%	100%

AI provenance

Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals.

Explicitly attributed share (lower bound): 100.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 100.0%

AI tool	Attributed commits	Lines added
Claude Code	17	15,189

Current source lines last changed by AI-attributed commits: 12,640 of 12,640.

Too few lines in one group to compare finding densities.

Month	Lines added	Attributed to AI
2026-10	15,040	100%
2026-11	149	100%

Evidence

Claude Code: trailer 'Co-Authored-By: Claude' (0272906902c3)
Claude Code: trailer 'Co-Authored-By: Claude' (ba273ab50c60)
Claude Code: trailer 'Co-Authored-By: Claude' (52467f99c602)
Claude Code: trailer 'Co-Authored-By: Claude' (f4f45e713165)
Claude Code: trailer 'Co-Authored-By: Claude' (ad35c427df0c)
Claude Code: trailer 'Co-Authored-By: Claude' (245abe5fbcba)
Claude Code: trailer 'Co-Authored-By: Claude' (a8c4784289dc)
Claude Code: trailer 'Co-Authored-By: Claude' (42360539c10d)
Claude Code: trailer 'Co-Authored-By: Claude' (f6ffba4a5096)
Claude Code: trailer 'Co-Authored-By: Claude' (b8e581101327)
Claude Code: trailer 'Co-Authored-By: Claude' (32c62004fe45)
Claude Code: trailer 'Co-Authored-By: Claude' (f3d365adde77)
Claude Code: trailer 'Co-Authored-By: Claude' (08b63ffced3b)
Claude Code: trailer 'Co-Authored-By: Claude' (5f2608c2e12a)
Claude Code: trailer 'Co-Authored-By: Claude' (9ca6cd53356a)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.20, no CI test run detected; 32% of function code in complex or long functions; 0% duplicated lines. Weakest area: complexity.

Area	Score
Complexity (lizard)	38
Duplication	100
Code smells (Opengrep)	67
Tests and CI	55
Documentation	65
Type safety	40
Process (Scorecard review/maintenance)	n/a

Functions: 2,319; mean complexity 3.7, 90th percentile 8; 80 complex and 5 long functions
Duplicated lines: 0.0% of 10,598 compared
Tests: 2,516 test lines for 12,640 source lines (ratio 0.20); CI test commands: none detected; 100% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is weak: 4 high-severity SAST findings; 3 high-severity workflow issues. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	90
Static analysis (Opengrep)	63
Vulnerable dependencies (OSV)	n/a
CI workflows (zizmor)	61
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles

Top findings

Severity	Finding	Location
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	studio/studio.js:33
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `t.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	studio/studio.js:33
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	studio/studio.js:317
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `ctx.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	studio/studio.js:317
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/publish.yml:23
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/publish.yml:26
high	`zizmor/cache-poisoning`: runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]	.github/workflows/publish.yml:26
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	cli/lib/capture.js:27
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`: RegExp() called with a `n` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]	cli/lib/capture.js:31
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	cli/lib/export.js:38
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	cli/lib/export.js:133
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	cli/lib/export.js:139
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	cli/lib/export.js:251
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	cli/lib/export.js:269
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	cli/lib/fonts.js:33
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`: RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]	cli/lib/fork.js:32
medium	`opengrep/javascript.lang.security.insecure-object-assign`: Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]	cli/lib/inbox.js:26
medium	`opengrep/javascript.lang.security.insecure-object-assign`: Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]	cli/lib/inbox.js:27
medium	`opengrep/javascript.lang.security.insecure-object-assign`: Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]	cli/lib/inbox.js:28
medium	`opengrep/javascript.lang.security.insecure-object-assign`: Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]	cli/lib/inbox.js:29
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	cli/lib/learn.js:99
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	cli/lib/project.js:16
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`: RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]	cli/lib/project.js:228
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	cli/lib/qa.js:100
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	cli/lib/score.js:142

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

star-burst: 2693 stars in 26 days (102/day)

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Source lines: 12,640; test lines: 2,516

Language	Lines
JavaScript	15,103
Python	53

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/alchaincyf/huashu-motion/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/alchaincyf/huashu-motion/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/alchaincyf/huashu-motion/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/alchaincyf/huashu-motion/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/alchaincyf/huashu-motion/security.svg)](https://repotrust.synapticcyber.com/r/github.com/alchaincyf/huashu-motion/)