duguyue100/midnight-captain

Inspired by Midnight Commander, tailored to my taste.

https://github.com/duguyue100/midnight-captain · commit 400875060ada · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/duguyue100/midnight-captain
Commit: 400875060ada16cce0545160da1b0532fc66dbb3
Generated: 2026-11-13T23:53:45+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	possible	49%	100%
Code quality	78	adequate	90%	100%
Security	67	weak	85%	100%

AI provenance

Weak signals consistent with AI-assisted development.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.0%
AI tooling configured in repo: generic-agent
Stylometry index: 0.09 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 1). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2026-04	8,440	0%

Evidence

AGENTS.md (generic-agent configuration) (AGENTS.md)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.42, CI runs tests; 20% of function code in complex or long functions; 3% duplicated lines. Weakest area: complexity.

Area	Score
Complexity (lizard)	56
Duplication	85
Code smells (Opengrep)	100
Tests and CI	83
Documentation	65
Type safety	n/a
Process (Scorecard review/maintenance)	n/a

Functions: 233; mean complexity 3.9, 90th percentile 9; 7 complex and 2 long functions
Duplicated lines: 2.7% of 3,799 compared
Tests: 2,244 test lines for 5,378 source lines (ratio 0.42); CI test commands: go test; 18% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is weak: 18 known vulnerabilities in 2 dependencies; 2 high-severity SAST findings; 10 high-severity workflow issues. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	91
Vulnerable dependencies (OSV)	74
CI workflows (zizmor)	14
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Known vulnerabilities: 18 in 2 packages (critical 7, high 2, medium 4, low 0)
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity	Finding	Location
critical	`osv/GHSA-jppx-rxg9-jmrx`: golang.org/x/[email protected] (Go) is affected by GO-2026-5005, GHSA-jppx-rxg9-jmrx	go.mod
critical	`osv/GHSA-f5wc-c3c7-36mc`: golang.org/x/[email protected] (Go) is affected by GO-2026-5006, GHSA-f5wc-c3c7-36mc	go.mod
critical	`osv/GHSA-vgwf-h737-ff37`: golang.org/x/[email protected] (Go) is affected by GO-2026-5017, GHSA-vgwf-h737-ff37	go.mod
critical	`osv/GHSA-89gr-r52h-f8rx`: golang.org/x/[email protected] (Go) is affected by GO-2026-5019, GHSA-89gr-r52h-f8rx	go.mod
critical	`osv/GHSA-rm3j-f69w-wqmq`: golang.org/x/[email protected] (Go) is affected by GO-2026-5020, GHSA-rm3j-f69w-wqmq	go.mod
critical	`osv/GHSA-5cgq-3rg8-m6cv`: golang.org/x/[email protected] (Go) is affected by GO-2026-5021, GHSA-5cgq-3rg8-m6cv	go.mod
critical	`osv/GHSA-x527-x647-q7gg`: golang.org/x/[email protected] (Go) is affected by GO-2026-5023, GHSA-x527-x647-q7gg	go.mod
high	`opengrep/go.lang.security.audit.dangerous-exec-command`: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]	internal/app/update.go:628
high	`opengrep/go.lang.security.audit.dangerous-exec-command`: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]	internal/app/update.go:672
high	`osv/GHSA-q4h4-gmj2-qvw2`: golang.org/x/[email protected] (Go) is affected by GO-2026-5013, GHSA-q4h4-gmj2-qvw2	go.mod
high	`osv/GHSA-w879-237q-wc7r`: golang.org/x/[email protected] (Go) is affected by GO-2026-5018, GHSA-w879-237q-wc7r	go.mod
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build.yml:16
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build.yml:19
high	`zizmor/excessive-permissions`: overly broad permissions [confidence high]	.github/workflows/release.yml:9
high	`zizmor/template-injection`: code injection via template expansion [confidence high]	.github/workflows/release.yml:82
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:29
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:32
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:50
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:63
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:66
high	`zizmor/cache-poisoning`: runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]	.github/workflows/release.yml:32
medium	`osv/GHSA-45gg-vh54-h5m9`: golang.org/x/[email protected] (Go) is affected by GO-2026-5014, GHSA-45gg-vh54-h5m9	go.mod
medium	`osv/GHSA-78mq-xcr3-xm33`: golang.org/x/[email protected] (Go) is affected by GO-2026-5015, GHSA-78mq-xcr3-xm33	go.mod
medium	`osv/GHSA-qpw4-5x99-6vjp`: golang.org/x/[email protected] (Go) is affected by GO-2026-5016, GHSA-qpw4-5x99-6vjp	go.mod
medium	`osv/GHSA-9m57-25v3-79x9`: golang.org/x/[email protected] (Go) is affected by GO-2026-5033, GHSA-9m57-25v3-79x9	go.mod

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 5,378; test lines: 2,244

Language	Lines
Go	7,469
Shell	153

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/duguyue100/midnight-captain/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/duguyue100/midnight-captain/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/duguyue100/midnight-captain/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/duguyue100/midnight-captain/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/duguyue100/midnight-captain/security.svg)](https://repotrust.synapticcyber.com/r/github.com/duguyue100/midnight-captain/)