wondelai/skills

Wondel.ai Agent Skills — Business, Marketing, UX & Coding Frameworks from Bestselling Books. 50 skills + 12 guided journeys for Claude Code, Codex, Cursor & other agentskills.io agents.

https://github.com/wondelai/skills · commit c5265583b1a9 · scored 2026-11-14 · scoring prov-4+qual-2+sec-2

unreviewed-ai-risk

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/wondelai/skills
Commit: c5265583b1a9740f06831e1d3e89b35bba3eb430
Generated: 2026-11-14T00:15:11+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Unreviewed AI code risk: a large share of this code is explicitly AI-attributed, and its tests or review process are weak while quality or security scores are low.

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	100	explicit	92%	100%
Code quality	61	weak	90%	100%
Security	65	weak	85%	100%

AI provenance

Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals.

Explicitly attributed share (lower bound): 100.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 100.0%

AI tool	Attributed commits	Lines added
Claude Code	81	476

AI tooling configured in repo: claude-code

Current source lines last changed by AI-attributed commits: 382 of 382.

Too few lines in one group to compare finding densities.

Month	Lines added	Attributed to AI
2026-02	61	100%
2026-06	42	100%
2026-07	98	100%
2026-08	151	100%
2026-11	124	100%

Evidence

Claude Code: trailer 'Co-authored-by: Claude' (c5265583b1a9)
Claude Code: trailer 'Co-authored-by: Claude' (f1775e769cac)
Claude Code: trailer 'Co-authored-by: Claude' (0d56bdf7e914)
Claude Code: trailer 'Co-Authored-By: Claude' (79a0452cef3c)
Claude Code: trailer 'Co-Authored-By: Claude' (c172996495be)
Claude Code: trailer 'Co-Authored-By: Claude' (6621b1f32cca)
Claude Code: trailer 'Co-Authored-By: Claude' (3a5623dd0b09)
Claude Code: trailer 'Co-Authored-By: Claude' (79bdb3a85711)
Claude Code: trailer 'Co-Authored-By: Claude' (790795fc5b7c)
Claude Code: trailer 'Co-Authored-By: Claude' (eee89d866704)
Claude Code: trailer 'Co-Authored-By: Claude' (b499bd982bd9)
Claude Code: trailer 'Co-Authored-By: Claude' (ab2d28a096f4)
Claude Code: trailer 'Co-Authored-By: Claude' (21f45e4cb9a5)
Claude Code: trailer 'Co-authored-by: Claude' (73de8a53f618)
Claude Code: trailer 'Co-Authored-By: Claude' (dd37ee506ff5)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 0% of function code in complex or long functions; 0% duplicated lines. Weakest area: testing.

Area	Score
Complexity (lizard)	100
Duplication	100
Code smells (Opengrep)	44
Tests and CI	15
Documentation	65
Type safety	n/a
Process (Scorecard review/maintenance)	n/a

Functions: 12; mean complexity 2.6, 90th percentile 5; 0 complex and 0 long functions
Duplicated lines: 0.0% of 288 compared
Tests: 0 test lines for 382 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Security

Security posture is weak: 6 high-severity workflow issues. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	90
Static analysis (Opengrep)	92
Vulnerable dependencies (OSV)	n/a
CI workflows (zizmor)	28
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity	Finding	Location
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/agent-skills-index.yml:36
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/claude-review.yml:30
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/claude-review.yml:36
high	`zizmor/template-injection`: code injection via template expansion [confidence high]	.github/workflows/sync-marketplace-version.yml:37
high	`zizmor/template-injection`: code injection via template expansion [confidence high]	.github/workflows/sync-marketplace-version.yml:38
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/sync-marketplace-version.yml:29
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	scripts/build-agent-skills-index.mjs:97
medium	`zizmor/artipacked`: credential persistence through GitHub Actions artifacts [confidence low]	.github/workflows/agent-skills-index.yml:35
medium	`zizmor/artipacked`: credential persistence through GitHub Actions artifacts [confidence low]	.github/workflows/claude-review.yml:29
medium	`zizmor/artipacked`: credential persistence through GitHub Actions artifacts [confidence low]	.github/workflows/sync-marketplace-version.yml:28
low	`gitleaks/generic-api-key`: Possible generic-api-key secret in the current tree (test/docs/example file)	high-perf-browser/references/real-time-communication.md:52
low	`gitleaks/generic-api-key`: Possible generic-api-key secret in the current tree (test/docs/example file)	plugins/systems-architecture/skills/high-perf-browser/references/real-time-communication.md:52
low	`gitleaks/generic-api-key`: Possible generic-api-key secret in the current tree (test/docs/example file)	plugins/wondelai-skills/skills/high-perf-browser/references/real-time-communication.md:52
info	`zizmor/template-injection`: code injection via template expansion [confidence low]	.github/workflows/sync-marketplace-version.yml:45
info	`zizmor/template-injection`: code injection via template expansion [confidence low]	.github/workflows/sync-marketplace-version.yml:56

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 382; test lines: 0

Language	Lines
Shell	258
JavaScript	124

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/wondelai/skills/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/wondelai/skills/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/wondelai/skills/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/wondelai/skills/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/wondelai/skills/security.svg)](https://repotrust.synapticcyber.com/r/github.com/wondelai/skills/)