RepoTrust

Leaderboard github.com

alchaincyf/huashu-motion

让你的agent一键直出商业级产品宣传片：会作曲，能指着画面改。Commercial-grade launch films by your coding agent — point at the frame to change it.

  • View repository ↗
  • JavaScript
  • ★ 2,693
  • commit 0272906902c3
  • scored 2026-11-14
  • scoring prov-4+qual-2+sec-2

AI provenance

100%

explicit

Confidence
74%
Coverage
100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

61/100

weak

Confidence
90%
Coverage
100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

63/100

weak

Confidence
85%
Coverage
100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON RepoTrust ai badgeRepoTrust quality badgeRepoTrust security badge

Scores

Pillar Score Signal Confidence Coverage
AI provenance (estimated AI-generated share) 100 explicit 74% 100%
Code quality 61 weak 90% 100%
Security 63 weak 85% 100%

AI provenance

Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals.

  • Explicitly attributed share (lower bound): 100.0%
  • Unattributed share in AI-consistent velocity bursts: 0.0%
  • Estimated AI-generated share: 100.0%
AI tool Attributed commits Lines added
Claude Code 17 15,189

Current source lines last changed by AI-attributed commits: 12,640 of 12,640.

Too few lines in one group to compare finding densities.

Month Lines added Attributed to AI
2026-10 15,040 100%
2026-11 149 100%

Evidence

  • Claude Code: trailer 'Co-Authored-By: Claude' (0272906902c3)
  • Claude Code: trailer 'Co-Authored-By: Claude' (ba273ab50c60)
  • Claude Code: trailer 'Co-Authored-By: Claude' (52467f99c602)
  • Claude Code: trailer 'Co-Authored-By: Claude' (f4f45e713165)
  • Claude Code: trailer 'Co-Authored-By: Claude' (ad35c427df0c)
  • Claude Code: trailer 'Co-Authored-By: Claude' (245abe5fbcba)
  • Claude Code: trailer 'Co-Authored-By: Claude' (a8c4784289dc)
  • Claude Code: trailer 'Co-Authored-By: Claude' (42360539c10d)
  • Claude Code: trailer 'Co-Authored-By: Claude' (f6ffba4a5096)
  • Claude Code: trailer 'Co-Authored-By: Claude' (b8e581101327)
  • Claude Code: trailer 'Co-Authored-By: Claude' (32c62004fe45)
  • Claude Code: trailer 'Co-Authored-By: Claude' (f3d365adde77)
  • Claude Code: trailer 'Co-Authored-By: Claude' (08b63ffced3b)
  • Claude Code: trailer 'Co-Authored-By: Claude' (5f2608c2e12a)
  • Claude Code: trailer 'Co-Authored-By: Claude' (9ca6cd53356a)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.20, no CI test run detected; 32% of function code in complex or long functions; 0% duplicated lines. Weakest area: complexity.

Area Score
Complexity (lizard) 38
Duplication 100
Code smells (Opengrep) 67
Tests and CI 55
Documentation 65
Type safety 40
Process (Scorecard review/maintenance) n/a
  • Functions: 2,319; mean complexity 3.7, 90th percentile 8; 80 complex and 5 long functions
  • Duplicated lines: 0.0% of 10,598 compared
  • Tests: 2,516 test lines for 12,640 source lines (ratio 0.20); CI test commands: none detected; 100% of recent source commits also change tests
  • Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is weak: 4 high-severity SAST findings; 3 high-severity workflow issues. Weakest area: posture.

Area Score
Secrets (gitleaks, tree + history) 90
Static analysis (Opengrep) 63
Vulnerable dependencies (OSV) n/a
CI workflows (zizmor) 61
Posture (policy, updates, signing, lockfiles) 0
OpenSSF Scorecard n/a
  • Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles

Top findings

Severity Finding Location
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] studio/studio.js:33
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a t.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] studio/studio.js:33
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] studio/studio.js:317
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a ctx.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] studio/studio.js:317
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/publish.yml:23
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/publish.yml:26
high zizmor/cache-poisoning: runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] .github/workflows/publish.yml:26
medium opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] cli/lib/capture.js:27
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp: RegExp() called with a n function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low] cli/lib/capture.js:31
medium opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] cli/lib/export.js:38
medium opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] cli/lib/export.js:133
medium opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] cli/lib/export.js:139
medium opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] cli/lib/export.js:251
medium opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] cli/lib/export.js:269
medium opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] cli/lib/fonts.js:33
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp: RegExp() called with a name function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low] cli/lib/fork.js:32
medium opengrep/javascript.lang.security.insecure-object-assign: Depending on the context, user control data in Object.assign can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low] cli/lib/inbox.js:26
medium opengrep/javascript.lang.security.insecure-object-assign: Depending on the context, user control data in Object.assign can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low] cli/lib/inbox.js:27
medium opengrep/javascript.lang.security.insecure-object-assign: Depending on the context, user control data in Object.assign can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low] cli/lib/inbox.js:28
medium opengrep/javascript.lang.security.insecure-object-assign: Depending on the context, user control data in Object.assign can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low] cli/lib/inbox.js:29
medium opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] cli/lib/learn.js:99
medium opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] cli/lib/project.js:16
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp: RegExp() called with a name function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low] cli/lib/project.js:228
medium opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] cli/lib/qa.js:100
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] cli/lib/score.js:142

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

  • star-burst: 2693 stars in 26 days (102/day)

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

  • Source lines: 12,640; test lines: 2,516
Language Lines
JavaScript 15,103
Python 53

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/alchaincyf/huashu-motion/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/alchaincyf/huashu-motion/)
[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/alchaincyf/huashu-motion/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/alchaincyf/huashu-motion/)
[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/alchaincyf/huashu-motion/security.svg)](https://repotrust.synapticcyber.com/r/github.com/alchaincyf/huashu-motion/)