{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-14T00:12:01.421241Z","repo":{"ref":{"host":"github.com","owner":"oil-oil","name":"oil-motion"},"default_branch":"main","clone_url":"https://github.com/oil-oil/oil-motion.git","html_url":"https://github.com/oil-oil/oil-motion","description":"Web animation skill for Claude Code & Codex. 帮你做跟着滚动和鼠标动的网页动画。","stars":2900,"forks":210,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":3147,"primary_language":"Python","license_spdx":"MIT","created_at":"2026-08-07T12:36:33Z","pushed_at":"2026-10-04T14:54:13Z","security_policy_url":null,"distribution":{"owner_created_at":"2019-11-06T22:54:33Z","owner_type":"User","release_assets":[]}},"commit_sha":"07e31f2265f80caa8f2c1df825d85ac24a46307c","profile":{"lines_by_language":{"Python":7382,"TypeScript":2217,"JavaScript":145},"files_by_category":{"source":26,"docs":20,"test":17,"config":13,"other":6,"oversized":2,"binary":1,"generated":1},"source_lines":7516,"test_lines":2228},"pillars":{"ai_provenance":{"score":4.9,"confidence":0.76,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.0486,"suspected_share":0.0,"estimated_share":0.0486,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null},"summary":"Explicit AI attribution on 5% of first-party code added; an estimated 5% including velocity signals."},"quality":{"score":71.4,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":43.6,"duplication":92.4,"lint":96.7,"testing":79.8,"docs":65.0,"type_safety":13.6,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.30, CI runs tests; 28% of function code in complex or long functions; 1% duplicated lines. Weakest area: type safety."},"security":{"score":73.3,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":96.7,"sast":82.0,"dependencies":77.9,"ci_actions":65.4,"posture":0.0,"scorecard":null},"summary":"Security posture is adequate: 55 known vulnerabilities in 1 dependencies; 4 high-severity SAST findings; 2 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":7.0,"checked":7.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":25.0,"attributed_commits":2.0,"attributed_commit_share":0.08,"effective_loc":10167.0,"attributed_loc":494.0,"attributed_loc_share":0.048588570866528964,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 2 attributed commits, 494 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"8e4d1c3d0eab6aedd656f4a1afcd16b6633f83ee","url":"https://github.com/oil-oil/oil-motion/commit/8e4d1c3d0eab6aedd656f4a1afcd16b6633f83ee","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"bd91c70b1158dc95c6705c81c3cb7baf0109ce01","url":"https://github.com/oil-oil/oil-motion/commit/bd91c70b1158dc95c6705c81c3cb7baf0109ce01","weight":0.9}],"data":{"attributed_loc_by_commit":{"bd91c70b1158dc95c6705c81c3cb7baf0109ce01":435,"8e4d1c3d0eab6aedd656f4a1afcd16b6633f83ee":59},"tools":{"claude-code":{"name":"Claude Code","commits":2,"loc":494,"first_seen":1790593581,"last_seen":1790748167}},"monthly":{"2026-08":{"loc":7951,"attributed_loc":0},"2026-09":{"loc":2216,"attributed_loc":494},"2026-10":{"loc":0,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":10.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":6564.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":380.75,"median_loc_per_hour":186.125,"pr_timed_units":2.0,"excluded_import_loc":3603.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["21f58d5f480da8d4b765d64300b6057918f3b490"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":7516.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":1.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"scripts/credential-ui/component.json","line":16,"fingerprint":"scripts/credential-ui/component.json:generic-api-key:16"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":9.0,"findings_high":4.0,"findings_medium":5.0,"findings_low":0.0,"weighted_findings":4.25,"scanned_lines":7516.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/compile_scroll_video.py","line":50,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/compile_scroll_video.py:50"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/media_edges.py","line":24,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/media_edges.py:24"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/motion_pipeline.py","line":61,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/motion_pipeline.py:61"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/optimize_motion.py","line":41,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/optimize_motion.py:41"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/image_job.py","line":131,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/image_job.py:131"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/image_job.py","line":157,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/image_job.py:157"},{"rule_id":"opengrep/python.lang.security.audit.non-literal-import","severity":"medium","message":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. [confidence low]","path":"scripts/secure_credentials.py","line":18,"fingerprint":"python.lang.security.audit.non-literal-import:scripts/secure_credentials.py:18"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/video_job.py","line":92,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/video_job.py:92"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/video_job.py","line":102,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/video_job.py:102"}],"evidence":[],"data":{"rulesets":["python","typescript","javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":1.0,"vulnerabilities":55.0,"vulns_critical":6.0,"vulns_high":34.0,"vulns_medium":13.0,"vulns_low":0.0,"vulns_unknown":2.0,"penalty":15.0},"findings":[{"rule_id":"osv/GHSA-5x8w-8jj5-q52h","severity":"critical","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-5x8w-8jj5-q52h"},{"rule_id":"osv/GHSA-8g5g-8vmr-9782","severity":"critical","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-8g5g-8vmr-9782"},{"rule_id":"osv/GHSA-xvh5-g6gv-559v","severity":"critical","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-xvh5-g6gv-559v"},{"rule_id":"osv/GHSA-3f63-hfp8-52jq","severity":"critical","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-457, GHSA-3f63-hfp8-52jq","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-3f63-hfp8-52jq"},{"rule_id":"osv/GHSA-332p-7hrc-92wf","severity":"critical","message":"pillow@10.0.0 (PyPI) is affected by GHSA-332p-7hrc-92wf","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-332p-7hrc-92wf"},{"rule_id":"osv/GHSA-w889-685w-c8fh","severity":"critical","message":"pillow@10.0.0 (PyPI) is affected by GHSA-w889-685w-c8fh","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-w889-685w-c8fh"},{"rule_id":"osv/GHSA-44wm-f244-xhp3","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-1793, GHSA-44wm-f244-xhp3","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-44wm-f244-xhp3"},{"rule_id":"osv/GHSA-j7hp-h8jx-5ppr","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-1794, GHSA-j7hp-h8jx-5ppr","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-j7hp-h8jx-5ppr"},{"rule_id":"osv/GHSA-8v84-f9pq-wr9x","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2253, GHSA-8v84-f9pq-wr9x","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-8v84-f9pq-wr9x"},{"rule_id":"osv/GHSA-5x94-69rx-g8h2","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2254, GHSA-5x94-69rx-g8h2","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-5x94-69rx-g8h2"},{"rule_id":"osv/GHSA-45hq-cxwh-f6vc","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2255, GHSA-45hq-cxwh-f6vc","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-45hq-cxwh-f6vc"},{"rule_id":"osv/GHSA-phj9-mv4w-65pm","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2256, GHSA-phj9-mv4w-65pm","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-phj9-mv4w-65pm"},{"rule_id":"osv/GHSA-6r8x-57c9-28j4","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3451, GHSA-6r8x-57c9-28j4","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-6r8x-57c9-28j4"},{"rule_id":"osv/GHSA-9hw9-ch79-4vh6","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3453, GHSA-9hw9-ch79-4vh6","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-9hw9-ch79-4vh6"},{"rule_id":"osv/GHSA-xj96-63gp-2gmr","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3454, GHSA-xj96-63gp-2gmr","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-xj96-63gp-2gmr"},{"rule_id":"osv/GHSA-62p4-gmf7-7g93","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3493, GHSA-62p4-gmf7-7g93","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-62p4-gmf7-7g93"},{"rule_id":"osv/GHSA-jjj6-mw9f-p565","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3495, GHSA-jjj6-mw9f-p565","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-jjj6-mw9f-p565"},{"rule_id":"osv/GHSA-vjc4-5qp5-m44j","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3496, GHSA-vjc4-5qp5-m44j","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-vjc4-5qp5-m44j"},{"rule_id":"osv/GHSA-27h8-gf7j-v5hc","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4326, GHSA-27h8-gf7j-v5hc","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-27h8-gf7j-v5hc"},{"rule_id":"osv/GHSA-4558-3h8r-v8xp","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4327, GHSA-4558-3h8r-v8xp","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-4558-3h8r-v8xp"},{"rule_id":"osv/GHSA-58r4-6rv3-gfh8","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4329, GHSA-58r4-6rv3-gfh8","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-58r4-6rv3-gfh8"},{"rule_id":"osv/GHSA-7mwm-ghpf-9vrm","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4331, GHSA-7mwm-ghpf-9vrm","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-7mwm-ghpf-9vrm"},{"rule_id":"osv/GHSA-pchr-8j38-3x4p","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4334, GHSA-pchr-8j38-3x4p","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-pchr-8j38-3x4p"},{"rule_id":"osv/GHSA-xgh8-jp6q-p5x8","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4335, GHSA-xgh8-jp6q-p5x8","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-xgh8-jp6q-p5x8"},{"rule_id":"osv/GHSA-g842-9rc4-69pw","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4338, GHSA-g842-9rc4-69pw","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-g842-9rc4-69pw"},{"rule_id":"osv/GHSA-3j72-p6qg-6xp7","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4341, GHSA-3j72-p6qg-6xp7","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-3j72-p6qg-6xp7"},{"rule_id":"osv/GHSA-9v9v-9qvf-h2hj","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4343, GHSA-9v9v-9qvf-h2hj","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-9v9v-9qvf-h2hj"},{"rule_id":"osv/GHSA-22hg-r758-rrw9","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-22hg-r758-rrw9","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-22hg-r758-rrw9"},{"rule_id":"osv/GHSA-5xm2-6676-qcp9","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-5xm2-6676-qcp9","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-5xm2-6676-qcp9"},{"rule_id":"osv/GHSA-65qm-jvmh-6pqg","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-65qm-jvmh-6pqg","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-65qm-jvmh-6pqg"},{"rule_id":"osv/GHSA-c6hw-5grf-ff96","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-c6hw-5grf-ff96","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-c6hw-5grf-ff96"},{"rule_id":"osv/GHSA-f2g6-542v-9j58","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-f2g6-542v-9j58","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-f2g6-542v-9j58"},{"rule_id":"osv/GHSA-g7cr-3p24-7wf7","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-g7cr-3p24-7wf7","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-g7cr-3p24-7wf7"},{"rule_id":"osv/GHSA-gg2r-wvfm-q9rx","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-gg2r-wvfm-q9rx","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-gg2r-wvfm-q9rx"},{"rule_id":"osv/GHSA-j4m9-6w36-pw47","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-j4m9-6w36-pw47","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-j4m9-6w36-pw47"},{"rule_id":"osv/GHSA-jg86-v3jv-hrpm","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-jg86-v3jv-hrpm","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-jg86-v3jv-hrpm"},{"rule_id":"osv/GHSA-mrfp-p49p-3hf2","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-mrfp-p49p-3hf2","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-mrfp-p49p-3hf2"},{"rule_id":"osv/GHSA-p4wg-p73j-c528","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-p4wg-p73j-c528","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-p4wg-p73j-c528"},{"rule_id":"osv/GHSA-q45j-58j2-45rg","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-q45j-58j2-45rg","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-q45j-58j2-45rg"},{"rule_id":"osv/GHSA-xcvg-w56q-r89m","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-xcvg-w56q-r89m","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-xcvg-w56q-r89m"},{"rule_id":"osv/PYSEC-2023-175","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2023-175","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):PYSEC-2023-175"},{"rule_id":"osv/GHSA-wjx4-4jcj-g98j","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-165, GHSA-wjx4-4jcj-g98j","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-wjx4-4jcj-g98j"},{"rule_id":"osv/GHSA-4x4j-2g7c-83w6","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2257, GHSA-4x4j-2g7c-83w6","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-4x4j-2g7c-83w6"},{"rule_id":"osv/GHSA-r73j-pqj5-w3x7","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2874, GHSA-r73j-pqj5-w3x7","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-r73j-pqj5-w3x7"},{"rule_id":"osv/GHSA-fj7v-r99m-22gq","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3494, GHSA-fj7v-r99m-22gq","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-fj7v-r99m-22gq"},{"rule_id":"osv/GHSA-p8hx-v2p6-rp84","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4337, GHSA-p8hx-v2p6-rp84","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-p8hx-v2p6-rp84"},{"rule_id":"osv/GHSA-4rm8-3hmm-39fg","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4340, GHSA-4rm8-3hmm-39fg","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-4rm8-3hmm-39fg"},{"rule_id":"osv/GHSA-24rc-8hj2-v98c","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-24rc-8hj2-v98c","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-24rc-8hj2-v98c"},{"rule_id":"osv/GHSA-254f-3936-288h","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-254f-3936-288h","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-254f-3936-288h"},{"rule_id":"osv/GHSA-462x-pgg6-55fp","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-462x-pgg6-55fp","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-462x-pgg6-55fp"},{"rule_id":"osv/GHSA-74r2-7ff9-mjj2","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-74r2-7ff9-mjj2","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-74r2-7ff9-mjj2"},{"rule_id":"osv/GHSA-fc9g-5qg7-mf45","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-fc9g-5qg7-mf45","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-fc9g-5qg7-mf45"},{"rule_id":"osv/GHSA-rfgq-q3w2-pmv2","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-rfgq-q3w2-pmv2","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-rfgq-q3w2-pmv2"},{"rule_id":"osv/GHSA-vx6w-vv9f-6gvg","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-vx6w-vv9f-6gvg","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-vx6w-vv9f-6gvg"},{"rule_id":"osv/GHSA-wqgw-9xfh-qf2g","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-wqgw-9xfh-qf2g","path":"scripts/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-wqgw-9xfh-qf2g"}],"evidence":[],"data":{"ecosystems":["PyPI","npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":4.0,"findings_high":2.0,"findings_medium":1.0,"findings_low":1.0,"penalty":25.5},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/tests.yml","line":17,"fingerprint":"unpinned-uses:.github/workflows/tests.yml:17"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/tests.yml","line":20,"fingerprint":"unpinned-uses:.github/workflows/tests.yml:20"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/credential-ui.yml","line":15,"fingerprint":"artipacked:.github/workflows/credential-ui.yml:15"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/tests.yml","line":16,"fingerprint":"artipacked:.github/workflows/tests.yml:16"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.12,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":395.0,"function_nloc":6441.0,"mean_ccn":4.16,"p90_ccn":9.0,"complex_functions":12.0,"long_functions":8.0,"many_param_functions":2.0,"risky_nloc_share":0.2767},"findings":[],"evidence":[{"kind":"complex-function","description":"compile_motion in scripts/compile_scroll_video.py: complexity 58, 450 lines","ref":"scripts/compile_scroll_video.py","url":"https://github.com/oil-oil/oil-motion/blob/07e31f2265f80caa8f2c1df825d85ac24a46307c/scripts/compile_scroll_video.py#L616","weight":0.9666666666666667},{"kind":"complex-function","description":"(anonymous) in scripts/credential-ui/src/server.ts: complexity 49, 82 lines","ref":"scripts/credential-ui/src/server.ts","url":"https://github.com/oil-oil/oil-motion/blob/07e31f2265f80caa8f2c1df825d85ac24a46307c/scripts/credential-ui/src/server.ts#L47","weight":0.8166666666666667},{"kind":"complex-function","description":"build_payload in scripts/video_job.py: complexity 33, 68 lines","ref":"scripts/video_job.py","url":"https://github.com/oil-oil/oil-motion/blob/07e31f2265f80caa8f2c1df825d85ac24a46307c/scripts/video_job.py#L243","weight":0.55},{"kind":"complex-function","description":"command_atlas in scripts/optimize_motion.py: complexity 31, 207 lines","ref":"scripts/optimize_motion.py","url":"https://github.com/oil-oil/oil-motion/blob/07e31f2265f80caa8f2c1df825d85ac24a46307c/scripts/optimize_motion.py#L277","weight":0.5166666666666667},{"kind":"complex-function","description":"analyze_directory in scripts/motion_pipeline.py: complexity 29, 150 lines","ref":"scripts/motion_pipeline.py","url":"https://github.com/oil-oil/oil-motion/blob/07e31f2265f80caa8f2c1df825d85ac24a46307c/scripts/motion_pipeline.py#L533","weight":0.48333333333333334},{"kind":"complex-function","description":"command_video in scripts/optimize_motion.py: complexity 29, 149 lines","ref":"scripts/optimize_motion.py","url":"https://github.com/oil-oil/oil-motion/blob/07e31f2265f80caa8f2c1df825d85ac24a46307c/scripts/optimize_motion.py#L592","weight":0.48333333333333334},{"kind":"complex-function","description":"main in scripts/credential-ui/src/cli.ts: complexity 21, 33 lines","ref":"scripts/credential-ui/src/cli.ts","url":"https://github.com/oil-oil/oil-motion/blob/07e31f2265f80caa8f2c1df825d85ac24a46307c/scripts/credential-ui/src/cli.ts#L59","weight":0.35},{"kind":"complex-function","description":"configureManifest in scripts/credential-ui/src/cli.ts: complexity 20, 21 lines","ref":"scripts/credential-ui/src/cli.ts","url":"https://github.com/oil-oil/oil-motion/blob/07e31f2265f80caa8f2c1df825d85ac24a46307c/scripts/credential-ui/src/cli.ts#L38","weight":0.3333333333333333},{"kind":"complex-function","description":"build_report in scripts/motion_budget.py: complexity 20, 106 lines","ref":"scripts/motion_budget.py","url":"https://github.com/oil-oil/oil-motion/blob/07e31f2265f80caa8f2c1df825d85ac24a46307c/scripts/motion_budget.py#L129","weight":0.3333333333333333},{"kind":"complex-function","description":"select_delivery in scripts/motion_budget.py: complexity 19, 61 lines","ref":"scripts/motion_budget.py","url":"https://github.com/oil-oil/oil-motion/blob/07e31f2265f80caa8f2c1df825d85ac24a46307c/scripts/motion_budget.py#L64","weight":0.31666666666666665}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":5930.0,"duplicated_lines":78.0,"duplicated_share":0.0132,"files":26.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/compile_scroll_video.py:350 and scripts/compile_scroll_video.py:538","ref":"scripts/compile_scroll_video.py","url":"https://github.com/oil-oil/oil-motion/blob/07e31f2265f80caa8f2c1df825d85ac24a46307c/scripts/compile_scroll_video.py#L350","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/credential-ui/public/app.js:135 and scripts/credential-ui/web/app.ts:87","ref":"scripts/credential-ui/public/app.js","url":"https://github.com/oil-oil/oil-motion/blob/07e31f2265f80caa8f2c1df825d85ac24a46307c/scripts/credential-ui/public/app.js#L135","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/motion_budget.py:207 and scripts/optimize_motion.py:464","ref":"scripts/motion_budget.py","url":"https://github.com/oil-oil/oil-motion/blob/07e31f2265f80caa8f2c1df825d85ac24a46307c/scripts/motion_budget.py#L207","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/motion_pipeline.py:60 and scripts/optimize_motion.py:40","ref":"scripts/motion_pipeline.py","url":"https://github.com/oil-oil/oil-motion/blob/07e31f2265f80caa8f2c1df825d85ac24a46307c/scripts/motion_pipeline.py#L60","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/motion_pipeline.py:890 and scripts/motion_pipeline.py:959","ref":"scripts/motion_pipeline.py","url":"https://github.com/oil-oil/oil-motion/blob/07e31f2265f80caa8f2c1df825d85ac24a46307c/scripts/motion_pipeline.py#L890","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/optimize_motion.py:284 and scripts/optimize_motion.py:597","ref":"scripts/optimize_motion.py","url":"https://github.com/oil-oil/oil-motion/blob/07e31f2265f80caa8f2c1df825d85ac24a46307c/scripts/optimize_motion.py#L284","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":4.0,"weighted_findings":1.0,"scanned_lines":7516.0,"category:correctness":4.0},"findings":[{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"assets/chroma-video-renderer.ts","line":36,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:assets/chroma-video-renderer.ts:36"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"assets/chroma-video-renderer.ts","line":36,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:assets/chroma-video-renderer.ts:36"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"assets/chroma-video-renderer.ts","line":49,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:assets/chroma-video-renderer.ts:49"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"assets/chroma-video-renderer.ts","line":49,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:assets/chroma-video-renderer.ts:49"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.5929,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":2228.0,"source_lines":7516.0,"test_ratio":0.2964,"ci_files":2.0,"cochange_share":0.8182,"cochange_commits":11.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/credential-ui.yml","ref":".github/workflows/credential-ui.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/tests.yml","ref":".github/workflows/tests.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm test, unittest)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm test","unittest"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":124.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.2271,"check:low_escape_density":0.0,"escapes":85.0,"escapes_per_kloc":11.532},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: scripts/credential-ui/tsconfig.json","ref":"scripts/credential-ui/tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":258.0,"other_lines":7258.0,"files_blamed":26.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:ai_per_kloc":0.0,"quality:other_findings":4.0,"quality:other_per_kloc":0.551,"security:ai_findings":2.0,"security:ai_per_kloc":7.752,"security:other_findings":7.0,"security:other_per_kloc":0.964},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}