amElnagdy/delegate-skills

Delegate a coding task to a separate coding agent CLI, review the diff, land the commit yourself — one per implementer.

https://github.com/amElnagdy/delegate-skills · commit 7f8ae3435e5b · scored 2026-11-14 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/amElnagdy/delegate-skills
Commit: 7f8ae3435e5bc68a54efdca9f67797e905845562
Generated: 2026-11-14T00:00:59+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	63	explicit	95%	100%
Code quality	54	weak	90%	100%
Security	86	strong	85%	100%

AI provenance

Explicit AI attribution on 63% of first-party code added; an estimated 63% including velocity signals.

Explicitly attributed share (lower bound): 63.3%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 63.3%

AI tool	Attributed commits	Lines added
Claude Code	111	12,509
Cursor agent	37	5,966
OpenAI Codex	26	1,938
GitHub Copilot coding agent	3	502

AI tooling configured in repo: cursor, generic-agent

Current source lines last changed by AI-attributed commits: 13,065 of 18,999.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Quality	1.607	2.865	0.56x
Security	0.077	1.517	0.05x

Month	Lines added	Attributed to AI
2026-06	822	38%
2026-07	10,674	55%
2026-08	14,309	71%
2026-09	1,585	34%
2026-10	5,585	71%
2026-11	47	100%

Evidence

Claude Code: on merged branch (e162cf43ff) (c020cc856fbb)
Claude Code: trailer 'Co-Authored-By: Claude' (f8cf688dab89)
Claude Code: trailer 'Co-Authored-By: Claude' (504767c78f66)
Claude Code: on merged branch (3aa72d681a) (ee56857892e4)
Claude Code: on merged branch (3aa72d681a) (5c39748c3faa)
Claude Code: on merged branch (8baa98f2b6) (ec93dd09476d)
Claude Code: on merged branch (3aa72d681a) (2a40a4b24ae1)
Claude Code: on merged branch (1d238e4510) (9bc4d8b1f985)
Claude Code: on merged branch (56e431e254) (974bdd40da1c)
Claude Code: trailer 'Co-Authored-By: Claude' (c9b6035c0159)
Claude Code: trailer 'Co-Authored-By: Claude' (ecd1a254b6a2)
Claude Code: trailer 'Co-Authored-By: Claude' (5ff7e378698c)
Claude Code: on merged branch (3aa72d681a) (351a8ff7f2f4)
Claude Code: on merged branch (3aa72d681a) (3ac47227f33a)
Claude Code: on merged branch (3aa72d681a) (0b8a89325767)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.41, no CI test run detected; 29% of function code in complex or long functions; 53% duplicated lines. Weakest area: duplication.

Area	Score
Complexity (lizard)	41
Duplication	4
Code smells (Opengrep)	82
Tests and CI	66
Documentation	80
Type safety	n/a
Process (Scorecard review/maintenance)	n/a

Functions: 1,122; mean complexity 5.3, 90th percentile 13; 100 complex and 2 long functions
Duplicated lines: 53.2% of 15,299 compared
Tests: 7,841 test lines for 18,999 source lines (ratio 0.41); CI test commands: none detected; 69% of recent source commits also change tests
Docs missing or thin: changelog

Most complex functions:

Security

Security posture is strong: 10 high-severity SAST findings. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	87
Vulnerable dependencies (OSV)	n/a
CI workflows (zizmor)	94
Posture (policy, updates, signing, lockfiles)	40
OpenSSF Scorecard	n/a

Posture checks passed: dependency updates, lockfiles; missing: security policy, signed commits

Top findings

Severity	Finding	Location
high	`opengrep/javascript.lang.security.audit.spawn-shell-true`: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low]	skills/cline-delegate/scripts/relay.mjs:549
high	`opengrep/javascript.lang.security.audit.spawn-shell-true`: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low]	skills/codex-delegate/scripts/relay.mjs:621
high	`opengrep/javascript.lang.security.audit.spawn-shell-true`: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low]	skills/commandcode-delegate/scripts/relay.mjs:381
high	`opengrep/javascript.lang.security.audit.spawn-shell-true`: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low]	skills/copilot-delegate/scripts/relay.mjs:544
high	`opengrep/javascript.lang.security.audit.spawn-shell-true`: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low]	skills/cursor-delegate/scripts/relay.mjs:548
high	`opengrep/javascript.lang.security.audit.spawn-shell-true`: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low]	skills/grok-delegate/scripts/relay.mjs:954
high	`opengrep/javascript.lang.security.audit.spawn-shell-true`: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low]	skills/mcode-delegate/scripts/relay.mjs:364
high	`opengrep/javascript.lang.security.audit.spawn-shell-true`: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low]	skills/opencode-delegate/scripts/relay.mjs:519
high	`opengrep/javascript.lang.security.audit.spawn-shell-true`: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low]	skills/pi-delegate/scripts/relay.mjs:561
high	`opengrep/javascript.lang.security.audit.spawn-shell-true`: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low]	skills/zcode-delegate/scripts/relay.mjs:398
medium	`zizmor/dependabot-cooldown`: insufficient cooldown in Dependabot updates [confidence high]	.github/dependabot.yml:3

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

readme-download-lure: gives an archive password

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Source lines: 18,999; test lines: 7,841

Language	Lines
JavaScript	26,597
C#	178
Shell	65

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/amElnagdy/delegate-skills/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/amElnagdy/delegate-skills/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/amElnagdy/delegate-skills/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/amElnagdy/delegate-skills/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/amElnagdy/delegate-skills/security.svg)](https://repotrust.synapticcyber.com/r/github.com/amElnagdy/delegate-skills/)