oil-oil/oil-motion

Web animation skill for Claude Code & Codex. 帮你做跟着滚动和鼠标动的网页动画。

https://github.com/oil-oil/oil-motion · commit 07e31f2265f8 · scored 2026-11-14 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/oil-oil/oil-motion
Commit: 07e31f2265f80caa8f2c1df825d85ac24a46307c
Generated: 2026-11-14T00:12:01+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	5	explicit	76%	100%
Code quality	71	adequate	90%	100%
Security	73	adequate	85%	100%

AI provenance

Explicit AI attribution on 5% of first-party code added; an estimated 5% including velocity signals.

Explicitly attributed share (lower bound): 4.9%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 4.9%

AI tool	Attributed commits	Lines added
Claude Code	2	494

Current source lines last changed by AI-attributed commits: 258 of 7,516.

Too few lines in one group to compare finding densities.

Month	Lines added	Attributed to AI
2026-08	7,951	0%
2026-09	2,216	22%

Evidence

Claude Code: trailer 'Co-Authored-By: Claude' (8e4d1c3d0eab)
Claude Code: trailer 'Co-Authored-By: Claude' (bd91c70b1158)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.30, CI runs tests; 28% of function code in complex or long functions; 1% duplicated lines. Weakest area: type safety.

Area	Score
Complexity (lizard)	44
Duplication	92
Code smells (Opengrep)	97
Tests and CI	80
Documentation	65
Type safety	14
Process (Scorecard review/maintenance)	n/a

Functions: 395; mean complexity 4.2, 90th percentile 9; 12 complex and 8 long functions
Duplicated lines: 1.3% of 5,930 compared
Tests: 2,228 test lines for 7,516 source lines (ratio 0.30); CI test commands: npm test, unittest; 82% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is adequate: 55 known vulnerabilities in 1 dependencies; 4 high-severity SAST findings; 2 high-severity workflow issues. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	97
Static analysis (Opengrep)	82
Vulnerable dependencies (OSV)	78
CI workflows (zizmor)	65
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Known vulnerabilities: 55 in 1 packages (critical 6, high 34, medium 13, low 0)
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity	Finding	Location
critical	`osv/GHSA-5x8w-8jj5-q52h`: [email protected] (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h	scripts/requirements.txt
critical	`osv/GHSA-8g5g-8vmr-9782`: [email protected] (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782	scripts/requirements.txt
critical	`osv/GHSA-xvh5-g6gv-559v`: [email protected] (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v	scripts/requirements.txt
critical	`osv/GHSA-3f63-hfp8-52jq`: [email protected] (PyPI) is affected by PYSEC-2026-457, GHSA-3f63-hfp8-52jq	scripts/requirements.txt
critical	`osv/GHSA-332p-7hrc-92wf`: [email protected] (PyPI) is affected by GHSA-332p-7hrc-92wf	scripts/requirements.txt
critical	`osv/GHSA-w889-685w-c8fh`: [email protected] (PyPI) is affected by GHSA-w889-685w-c8fh	scripts/requirements.txt
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	scripts/compile_scroll_video.py:50
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	scripts/media_edges.py:24
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	scripts/motion_pipeline.py:61
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	scripts/optimize_motion.py:41
high	`osv/GHSA-44wm-f244-xhp3`: [email protected] (PyPI) is affected by PYSEC-2026-1793, GHSA-44wm-f244-xhp3	scripts/requirements.txt
high	`osv/GHSA-j7hp-h8jx-5ppr`: [email protected] (PyPI) is affected by PYSEC-2026-1794, GHSA-j7hp-h8jx-5ppr	scripts/requirements.txt
high	`osv/GHSA-8v84-f9pq-wr9x`: [email protected] (PyPI) is affected by PYSEC-2026-2253, GHSA-8v84-f9pq-wr9x	scripts/requirements.txt
high	`osv/GHSA-5x94-69rx-g8h2`: [email protected] (PyPI) is affected by PYSEC-2026-2254, GHSA-5x94-69rx-g8h2	scripts/requirements.txt
high	`osv/GHSA-45hq-cxwh-f6vc`: [email protected] (PyPI) is affected by PYSEC-2026-2255, GHSA-45hq-cxwh-f6vc	scripts/requirements.txt
high	`osv/GHSA-phj9-mv4w-65pm`: [email protected] (PyPI) is affected by PYSEC-2026-2256, GHSA-phj9-mv4w-65pm	scripts/requirements.txt
high	`osv/GHSA-6r8x-57c9-28j4`: [email protected] (PyPI) is affected by PYSEC-2026-3451, GHSA-6r8x-57c9-28j4	scripts/requirements.txt
high	`osv/GHSA-9hw9-ch79-4vh6`: [email protected] (PyPI) is affected by PYSEC-2026-3453, GHSA-9hw9-ch79-4vh6	scripts/requirements.txt
high	`osv/GHSA-xj96-63gp-2gmr`: [email protected] (PyPI) is affected by PYSEC-2026-3454, GHSA-xj96-63gp-2gmr	scripts/requirements.txt
high	`osv/GHSA-62p4-gmf7-7g93`: [email protected] (PyPI) is affected by PYSEC-2026-3493, GHSA-62p4-gmf7-7g93	scripts/requirements.txt
high	`osv/GHSA-jjj6-mw9f-p565`: [email protected] (PyPI) is affected by PYSEC-2026-3495, GHSA-jjj6-mw9f-p565	scripts/requirements.txt
high	`osv/GHSA-vjc4-5qp5-m44j`: [email protected] (PyPI) is affected by PYSEC-2026-3496, GHSA-vjc4-5qp5-m44j	scripts/requirements.txt
high	`osv/GHSA-27h8-gf7j-v5hc`: [email protected] (PyPI) is affected by PYSEC-2026-4326, GHSA-27h8-gf7j-v5hc	scripts/requirements.txt
high	`osv/GHSA-4558-3h8r-v8xp`: [email protected] (PyPI) is affected by PYSEC-2026-4327, GHSA-4558-3h8r-v8xp	scripts/requirements.txt
high	`osv/GHSA-58r4-6rv3-gfh8`: [email protected] (PyPI) is affected by PYSEC-2026-4329, GHSA-58r4-6rv3-gfh8	scripts/requirements.txt

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 7,516; test lines: 2,228

Language	Lines
Python	7,382
TypeScript	2,217
JavaScript	145

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/oil-oil/oil-motion/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/oil-oil/oil-motion/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/oil-oil/oil-motion/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/oil-oil/oil-motion/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/oil-oil/oil-motion/security.svg)](https://repotrust.synapticcyber.com/r/github.com/oil-oil/oil-motion/)