Leaderboard github.com
0xSteph/pentest-ai-agents
Turn Claude Code into your offensive security research assistant. Specialized AI subagents for authorized penetration testing plan engagements, analyze recon, research exploits, build detections, audit STIGs, and write reports.
AI provenance
0%
possible
- Confidence
- 54%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
77/100
adequate
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
85/100
strong
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
- Repository: https://github.com/0xSteph/pentest-ai-agents
- Commit:
e5d7aa02c4c0c29a90e4789034b45e0cb7488e89 - Generated: 2026-11-13T23:59:24+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | possible | 54% | 100% |
| Code quality | 77 | adequate | 90% | 100% |
| Security | 85 | strong | 85% | 100% |
AI provenance
Weak signals consistent with AI-assisted development.
- Explicitly attributed share (lower bound): 0.0%
- Unattributed share in AI-consistent velocity bursts: 57.7%
- Estimated AI-generated share: 0.0%
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-03 | 1,924 | 0% |
| 2026-04 | 3,932 | 0% |
| 2026-05 | 20 | 0% |
| 2026-06 | 57 | 0% |
Evidence
- 3,426 lines of first-party code in ~4.1h (836 lines/hour, 2 commit session) (7fdde66a96e7)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.16, no CI test run detected; 3% duplicated lines. Weakest area: testing.
| Area | Score |
|---|---|
| Complexity (lizard) | n/a |
| Duplication | 84 |
| Code smells (Opengrep) | 100 |
| Tests and CI | 56 |
| Documentation | 85 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Duplicated lines: 3.0% of 1,563 compared
- Tests: 301 test lines for 1,939 source lines (ratio 0.16); CI test commands: none detected; 7% of recent source commits also change tests
- Docs missing or thin: contributing
Security
Security posture is strong: no high-impact findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 94 |
| Static analysis (Opengrep) | 86 |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | 100 |
| Posture (policy, updates, signing, lockfiles) | 40 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: security policy, lockfiles; missing: dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| medium | opengrep/bash.lang.security.ifs-tampering: The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS="," read -a my_array'. [confidence low] |
db/findings.sh:259 |
| medium | opengrep/bash.lang.security.ifs-tampering: The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS="," read -a my_array'. [confidence low] |
db/findings.sh:282 |
| medium | opengrep/bash.lang.security.ifs-tampering: The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS="," read -a my_array'. [confidence low] |
db/findings.sh:306 |
| low | gitleaks/curl-auth-user: Possible curl-auth-user secret in the current tree (test/docs/example file) |
agents/osint-collector.md:186 |
| low | gitleaks/curl-auth-user: Possible curl-auth-user secret in history (commit 4e368d63ce); removed from the current tree but still retrievable |
.claude/agents/osint-collector.md:186 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- readme-download-lure: gives an archive password
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 1,939; test lines: 301
| Language | Lines |
|---|---|
| Shell | 2,114 |
| SQL | 126 |