stardustai/dataset-viewer

A sleek dataset viewer built entirely by AI Agent. Supports streaming large files from WebDAV, S3, SSH, Local or Hugging Face.

https://github.com/stardustai/dataset-viewer · commit 47acb5065841 · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/stardustai/dataset-viewer
Commit: 47acb50658414581336580a57083ddc758ee4827
Generated: 2026-11-13T23:44:19+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	8	explicit	95%	100%
Code quality	52	weak	90%	100%
Security	48	poor	85%	100%

AI provenance

Explicit AI attribution on 7% of first-party code added; an estimated 7% including velocity signals.

Explicitly attributed share (lower bound): 7.5%
Unattributed share in AI-consistent velocity bursts: 17.0%
Estimated AI-generated share: 7.5%

AI tool	Attributed commits	Lines added
GitHub Copilot coding agent	8	6,479

AI tooling configured in repo: github-copilot

Current source lines last changed by AI-attributed commits: 4,421 of 43,700.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Quality	0.452	0.255	1.77x
Security	0.0	1.324	0.0x

Stylometry index: 0.99 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 87). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2025-07	35,517	0%
2025-08	30,790	7%
2025-09	18,284	24%
2025-10	2,183	5%

Evidence

GitHub Copilot coding agent: author Copilot (4a44f50ac3b1)
GitHub Copilot coding agent: author Copilot (259dbd1eea7a)
GitHub Copilot coding agent: author Copilot (0b75a94cc78f)
GitHub Copilot coding agent: author Copilot (7c6250d7997d)
GitHub Copilot coding agent: author Copilot (057f555d829e)
GitHub Copilot coding agent: author Copilot (f9a6a098cdb2)
GitHub Copilot coding agent: author Copilot (f9d0a932b766)
GitHub Copilot coding agent: author Copilot (8fa526cec705)
3,283 lines of first-party code in ~0.5h (6,566 lines/hour, 1 commit session) (bd335a1965b6)
3,134 lines of first-party code in ~0.8h (3,948 lines/hour, 3 commit session) (67dc25aecac5)
1,962 lines of first-party code in ~0.5h (3,924 lines/hour, 1 commit session) (b670bc53cba5)
.github/copilot-instructions.md (github-copilot configuration) (.github/copi)
v0.2.8 → v0.3.0: 10,935 lines in 1.52 days (7,194.4 lines/day) (v0.2.8...v0.)
v0.3.0 → v1.0.0-beta.0: 10,961 lines in 3.18 days (3,445.8 lines/day) (v0.3.0...v1.)
1,447 lines of first-party code in ~1.1h (1,322 lines/hour, PR #29) (f67c827b176d)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 20% of function code in complex or long functions; 9% duplicated lines. Weakest area: testing.

Area	Score
Complexity (lizard)	54
Duplication	58
Code smells (Opengrep)	95
Tests and CI	15
Documentation	40
Type safety	100
Process (Scorecard review/maintenance)	n/a

Functions: 1,900; mean complexity 3.4, 90th percentile 8; 49 complex and 30 long functions
Duplicated lines: 9.1% of 31,110 compared
Tests: 0 test lines for 43,700 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
Docs missing or thin: license, contributing, changelog

Most complex functions:

Security

Security posture is poor: 277 known vulnerabilities in 95 dependencies; 14 high-severity SAST findings; 22 high-severity workflow issues. Weakest area: dependencies.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	88
Vulnerable dependencies (OSV)	0
CI workflows (zizmor)	1
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Known vulnerabilities: 277 in 95 packages (critical 3, high 106, medium 83, low 23)
Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles

Top findings

Severity	Finding	Location
critical	`osv/GHSA-23hp-3jrh-7fpw`: [email protected] (npm) is affected by GHSA-23hp-3jrh-7fpw	pnpm-lock.yaml
critical	`osv/RUSTSEC-2026-0369`: [email protected] (crates.io) is affected by RUSTSEC-2026-0369	src-tauri/Cargo.lock
critical	`osv/GHSA-m665-v7pm-7grj`: [email protected] (crates.io) is affected by GHSA-m665-v7pm-7grj	src-tauri/Cargo.lock
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/components/FileViewer/common/UnifiedContentModal.tsx:175
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `tempDiv.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/components/FileViewer/common/UnifiedContentModal.tsx:175
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/components/FileViewer/viewers/PresentationViewer.tsx:122
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `txt.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/components/FileViewer/viewers/PresentationViewer.tsx:122
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/components/FileViewer/viewers/VirtualizedTextViewer.tsx:512
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `tempDiv.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/components/FileViewer/viewers/VirtualizedTextViewer.tsx:512
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/utils/syntaxHighlighter.ts:186
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `tempDiv.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/utils/syntaxHighlighter.ts:186
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/utils/syntaxHighlighter.ts:218
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `tempDiv.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/utils/syntaxHighlighter.ts:218
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/utils/syntaxHighlighter.ts:294
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `tempDiv.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/utils/syntaxHighlighter.ts:294
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/utils/syntaxHighlighter.ts:321
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `tempContainer.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/utils/syntaxHighlighter.ts:321
high	`osv/GHSA-3jxr-9vmj-r5cp`: [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp; also in packages/sdk/pnpm-lock.yaml; also in pnpm-lock.yaml	packages/cad-plugin/pnpm-lock.yaml
high	`osv/GHSA-6j4f-fj2g-mc7p`: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p; also in packages/sdk/pnpm-lock.yaml; also in pnpm-lock.yaml	packages/cad-plugin/pnpm-lock.yaml
high	`osv/GHSA-mh99-v99m-4gvg`: [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg; also in packages/sdk/pnpm-lock.yaml; also in pnpm-lock.yaml	packages/cad-plugin/pnpm-lock.yaml
high	`osv/GHSA-qhr7-859c-m2p7`: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7; also in packages/sdk/pnpm-lock.yaml; also in pnpm-lock.yaml	packages/cad-plugin/pnpm-lock.yaml
high	`osv/GHSA-rgw5-rvv9-x895`: [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895; also in packages/sdk/pnpm-lock.yaml; also in pnpm-lock.yaml	packages/cad-plugin/pnpm-lock.yaml
high	`osv/GHSA-3jxr-9vmj-r5cp`: [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp; also in packages/sdk/pnpm-lock.yaml; also in pnpm-lock.yaml	packages/cad-plugin/pnpm-lock.yaml
high	`osv/GHSA-6j4f-fj2g-mc7p`: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p; also in packages/sdk/pnpm-lock.yaml; also in pnpm-lock.yaml	packages/cad-plugin/pnpm-lock.yaml
high	`osv/GHSA-mh99-v99m-4gvg`: [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg; also in packages/sdk/pnpm-lock.yaml; also in pnpm-lock.yaml	packages/cad-plugin/pnpm-lock.yaml

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

binary-release-asset: release v1.6.4 ships Dataset.Viewer-1.6.4-1.x86_64.rpm (28 downloads)
binary-release-asset: release v1.6.4 ships Dataset.Viewer_1.6.4_aarch64.dmg (474 downloads)
binary-release-asset: release v1.6.4 ships Dataset.Viewer_1.6.4_amd64.AppImage (177 downloads)
binary-release-asset: release v1.6.4 ships Dataset.Viewer_1.6.4_amd64.deb (90 downloads)
binary-release-asset: release v1.6.4 ships Dataset.Viewer_1.6.4_x64.dmg (103 downloads)

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Source lines: 43,700; test lines: 0

Language	Lines
TypeScript	31,010
Rust	12,653
JavaScript	37

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/stardustai/dataset-viewer/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/stardustai/dataset-viewer/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/stardustai/dataset-viewer/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/stardustai/dataset-viewer/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/stardustai/dataset-viewer/security.svg)](https://repotrust.synapticcyber.com/r/github.com/stardustai/dataset-viewer/)