Urinx/WeixinBot

网页版微信API，包含终端版微信及微信机器人

https://github.com/Urinx/WeixinBot · commit d9edcd2c9203 · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/Urinx/WeixinBot
Commit: d9edcd2c9203fe7dd203b22b71bbc48a31e9492b
Generated: 2026-11-13T23:21:03+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	none-detected	65%	100%
Code quality	35	poor	90%	100%
Security	51	weak	85%	100%

AI provenance

No AI attribution or AI-consistent velocity signals detected.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.0%

Month	Lines added	Attributed to AI
2016-01	460	0%
2016-02	559	0%
2016-03	114	0%
2016-04	1,046	0%
2016-05	38	0%
2016-10	163	0%
2016-11	14	0%
2017-02	205	0%
2017-03	1	0%
2017-04	3,408	0%
2017-05	70	0%
2017-07	17	0%

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 15% of function code in complex or long functions; 9% duplicated lines. Weakest area: testing.

Area	Score
Complexity (lizard)	65
Duplication	59
Code smells (Opengrep)	11
Tests and CI	0
Documentation	65
Type safety	40
Process (Scorecard review/maintenance)	n/a

Functions: 206; mean complexity 3.2, 90th percentile 7; 4 complex and 2 long functions
Duplicated lines: 8.8% of 3,690 compared
Tests: 0 test lines for 4,608 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is weak: 1 possible secret(s) in the tree, 0 only in history; 25 high-severity SAST findings. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	62
Static analysis (Opengrep)	12
Vulnerable dependencies (OSV)	100
CI workflows (zizmor)	n/a
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity	Finding	Location
high	`gitleaks/sendgrid-api-token`: Possible sendgrid-api-token secret in the current tree	wxbot_project_py2.7/config/wechat.conf.bak:39
high	`opengrep/python.lang.security.use-defused-xml`: The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. [confidence low]	wxbot_demo_py3/weixin.py:9
high	`opengrep/python.lang.security.audit.dangerous-spawn-process-audit`: Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	wxbot_demo_py3/weixin.py:189
high	`opengrep/python.lang.security.audit.dangerous-system-call-audit`: Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]	wxbot_demo_py3/weixin.py:1051
high	`opengrep/python.lang.security.audit.dangerous-system-call-audit`: Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]	wxbot_demo_py3/weixin.py:1053
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	wxbot_project_py2.7/db/mysql_db.py:79
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	wxbot_project_py2.7/db/mysql_db.py:90
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	wxbot_project_py2.7/db/mysql_db.py:101
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	wxbot_project_py2.7/db/mysql_db.py:113
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	wxbot_project_py2.7/db/mysql_db.py:124
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	wxbot_project_py2.7/db/mysql_db.py:138
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	wxbot_project_py2.7/db/mysql_db.py:147
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	wxbot_project_py2.7/db/mysql_db.py:190
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	wxbot_project_py2.7/db/sqlite_db.py:56
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	wxbot_project_py2.7/db/sqlite_db.py:65
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	wxbot_project_py2.7/db/sqlite_db.py:75
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	wxbot_project_py2.7/db/sqlite_db.py:111
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	wxbot_project_py2.7/db/sqlite_db.py:115
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	wxbot_project_py2.7/db/sqlite_db.py:130
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	wxbot_project_py2.7/db/sqlite_db.py:139
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	wxbot_project_py2.7/db/sqlite_db.py:182
high	`opengrep/dockerfile.security.missing-user-entrypoint`: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]	wxbot_project_py2.7/docker/Dockerfile:17
high	`opengrep/dockerfile.security.missing-user`: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]	wxbot_project_py2.7/docker/Dockerfile:18
high	`opengrep/python.lang.security.use-defused-xml`: The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. [confidence low]	wxbot_project_py2.7/wechat/wechat_apis.py:15
high	`opengrep/python.lang.security.audit.dangerous-spawn-process-audit`: Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	wxbot_project_py2.7/wechat/wechat_apis.py:206

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 4,608; test lines: 0

Language	Lines
Python	4,608

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/Urinx/WeixinBot/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/Urinx/WeixinBot/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/Urinx/WeixinBot/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/Urinx/WeixinBot/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/Urinx/WeixinBot/security.svg)](https://repotrust.synapticcyber.com/r/github.com/Urinx/WeixinBot/)