vico-png/llamastation

Open-source llama.cpp GUI for Windows — multi-GPU, TurboQuant, headless mode

https://github.com/vico-png/llamastation · commit 35b6470831ef · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/vico-png/llamastation
Commit: 35b6470831efd300ec345b1542a8c88b944f453c
Generated: 2026-11-13T23:58:03+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	none-detected	48%	100%
Code quality	31	poor	90%	100%
Security	75	adequate	85%	100%

AI provenance

No AI attribution or AI-consistent velocity signals detected.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.0%
Stylometry index: 6.99 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 163). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2026-05	8,330	0%
2026-07	600	0%
2026-08	2,464	0%
2026-09	804	0%

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 39% of function code in complex or long functions; 4% duplicated lines. Weakest area: testing.

Area	Score
Complexity (lizard)	31
Duplication	78
Code smells (Opengrep)	12
Tests and CI	0
Documentation	65
Type safety	40
Process (Scorecard review/maintenance)	n/a

Functions: 387; mean complexity 4.9, 90th percentile 10; 19 complex and 13 long functions
Duplicated lines: 4.2% of 10,002 compared
Tests: 0 test lines for 11,653 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is adequate: 8 high-severity SAST findings. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	80
Vulnerable dependencies (OSV)	n/a
CI workflows (zizmor)	n/a
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity	Finding	Location
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	llamastation.py:1509
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	llamastation.py:4491
high	`opengrep/python.lang.security.audit.subprocess-shell-true`: Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. [confidence medium]	llamastation.py:4492
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	llamastation.py:6302
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	llamastation.py:6327
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	llamastation.py:6803
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	llamastation.py:6847
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	llamastation.py:7872
low	`opengrep/python.lang.security.audit.insecure-transport.requests.request-with-http`: Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. [confidence medium]	llamastation_telegram.py:416
low	`opengrep/python.lang.security.audit.insecure-transport.requests.request-with-http`: Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. [confidence medium]	llamastation_voice.py:999

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

binary-release-asset: release v0.9 ships LlamaStation-v0.9-windows.zip (332 downloads)

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Source lines: 11,653; test lines: 0

Language	Lines
Python	11,653

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/vico-png/llamastation/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/vico-png/llamastation/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/vico-png/llamastation/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/vico-png/llamastation/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/vico-png/llamastation/security.svg)](https://repotrust.synapticcyber.com/r/github.com/vico-png/llamastation/)