amontlabs/lcu
Codex computer use, decoupled from the app, for usage inside any harness.
unusual-traction
- Repository: https://github.com/amontlabs/lcu
- Commit:
c8e5693d7141c60ef42294c03b2eee2d88557a49 - Generated: 2026-11-14T00:01:32+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
Unusual traction: many stars in a few days on a newly created account, which is consistent with purchased or automated stars. Star count is not a reliable signal for this repository.
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 32 | explicit | 95% | 100% |
| Code quality | 73 | adequate | 90% | 100% |
| Security | 59 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 33% of first-party code added; an estimated 33% including velocity signals.
- Explicitly attributed share (lower bound): 32.6%
- Unattributed share in AI-consistent velocity bursts: 27.2%
- Estimated AI-generated share: 32.6%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 69 | 27,909 |
- AI tooling configured in repo: claude-code, generic-agent
Current source lines last changed by AI-attributed commits: 11,592 of 20,200.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 3.106 | 3.717 | 0.84x |
| Security | 0.69 | 2.091 | 0.33x |
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-09 | 31,923 | 4% |
| 2026-10 | 53,217 | 50% |
| 2026-11 | 608 | 24% |
Evidence
- Claude Code: PR description attribution (bcbceae03e70)
- Claude Code: trailer 'Co-Authored-By: Claude' (ed1e1cb84d14)
- Claude Code: trailer 'Co-Authored-By: Claude' (6257c85426bb)
- Claude Code: trailer 'Co-Authored-By: Claude' (8389f8ff98a5)
- Claude Code: PR description attribution (289d3cdffe85)
- Claude Code: trailer 'Co-Authored-By: Claude' (3df22ffb886d)
- Claude Code: PR branch 'claude/project-thread-oeuii6' (fbe4b0fdfd63)
- Claude Code: PR branch 'claude/project-thread-wp4nhn' (8d768bee5c9f)
- Claude Code: PR branch 'claude/project-thread-hk8ehz' (6fe7e941392c)
- Claude Code: trailer 'Co-Authored-By: Claude' (c3559c858d81)
- Claude Code: trailer 'Co-Authored-By: Claude' (559fdb9234d9)
- Claude Code: PR branch 'claude/stoic-cray-2fzmyi' (fe364a9ef47c)
- Claude Code: author email [email protected] (02cc9af0ca0c)
- Claude Code: PR description attribution (399ead3dca47)
- Claude Code: trailer 'Co-authored-by: Claude' (a2c48c210165)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 1.70, CI runs tests; 24% of function code in complex or long functions; 1% duplicated lines. Weakest area: type safety.
| Area | Score |
|---|---|
| Complexity (lizard) | 49 |
| Duplication | 95 |
| Code smells (Opengrep) | 66 |
| Tests and CI | 100 |
| Documentation | 65 |
| Type safety | 0 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 2,082; mean complexity 3.9, 90th percentile 10; 73 complex and 5 long functions
- Duplicated lines: 0.9% of 15,811 compared
- Tests: 34,393 test lines for 20,200 source lines (ratio 1.70); CI test commands: npm test, unittest; 74% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- registerLocked in lcu/setup.mjs: complexity 93, 143 lines
- validate in lcu/setup.mjs: complexity 56, 65 lines
- recoverStaleService in lcu/macos_host.mjs: complexity 55, 78 lines
- pickTarget in adapters/pi/index.ts: complexity 53, 206 lines
- hostModule in lcu/windows_host_analyze.cjs: complexity 52, 103 lines
Security
Security posture is weak: 23 known vulnerabilities in 8 dependencies; 8 high-severity SAST findings; 20 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 94 |
| Static analysis (Opengrep) | 83 |
| Vulnerable dependencies (OSV) | 52 |
| CI workflows (zizmor) | 2 |
| Posture (policy, updates, signing, lockfiles) | 20 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 23 in 8 packages (critical 0, high 6, medium 14, low 3)
-
Posture checks passed: signed commits, lockfiles; missing: security policy, dependency updates
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
adapters/hermes/init.py:76 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/build_bundle.py:100 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/build_bundle.py:172 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/check_windows_host_layout.py:63 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/check_windows_host_layout.py:81 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/provision_agent_tools.py:81 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/provision_agent_tools.py:91 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/provision_agent_tools.py:109 |
| high | osv/GHSA-22jm-h49p-29qw: @modelcontextprotocol/[email protected] (npm) is affected by GHSA-22jm-h49p-29qw |
adapters/package-lock.json |
| high | osv/GHSA-46jr-4wx8-v453: @modelcontextprotocol/[email protected] (npm) is affected by GHSA-46jr-4wx8-v453 |
adapters/package-lock.json |
| high | osv/GHSA-6qxp-vccf-f47h: @modelcontextprotocol/[email protected] (npm) is affected by GHSA-6qxp-vccf-f47h |
adapters/package-lock.json |
| high | osv/GHSA-f897-62hf-6gxq: @modelcontextprotocol/[email protected] (npm) is affected by GHSA-f897-62hf-6gxq |
adapters/package-lock.json |
| high | osv/GHSA-27r3-jxmh-p828: [email protected] (npm) is affected by GHSA-27r3-jxmh-p828 |
adapters/package-lock.json |
| high | osv/GHSA-mrhx-c7xc-m3w5: [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 |
adapters/package-lock.json |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:29 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:30 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:47 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:48 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:51 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:63 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:64 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:67 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:85 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:88 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:91 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v0.13.6 ships lcu-0.13.6-darwin-arm64.tar.gz (207 downloads)
- binary-release-asset: release v0.13.6 ships lcu-0.13.6-linux-arm64.tar.gz (4 downloads)
- binary-release-asset: release v0.13.6 ships lcu-0.13.6-linux-x64.tar.gz (10 downloads)
- binary-release-asset: release v0.13.5 ships lcu-0.13.5-darwin-arm64.tar.gz (562 downloads)
- binary-release-asset: release v0.13.5 ships lcu-0.13.5-linux-arm64.tar.gz (4 downloads)
- star-burst: 2422 stars in 52 days (46/day)
- new-owner: owner account is 41 days old with 2422 stars on this repo
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 20,200; test lines: 34,393
| Language | Lines |
|---|---|
| JavaScript | 37,276 |
| Python | 13,739 |
| TypeScript | 2,419 |
| Shell | 995 |
| Swift | 103 |
| PowerShell | 61 |