Leaderboard github.com
amElnagdy/delegate-skills
Delegate a coding task to a separate coding agent CLI, review the diff, land the commit yourself — one per implementer.
AI provenance
63%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
54/100
weak
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
86/100
strong
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
- Repository: https://github.com/amElnagdy/delegate-skills
- Commit:
7f8ae3435e5bc68a54efdca9f67797e905845562 - Generated: 2026-11-14T00:00:59+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 63 | explicit | 95% | 100% |
| Code quality | 54 | weak | 90% | 100% |
| Security | 86 | strong | 85% | 100% |
AI provenance
Explicit AI attribution on 63% of first-party code added; an estimated 63% including velocity signals.
- Explicitly attributed share (lower bound): 63.3%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 63.3%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 111 | 12,509 |
| Cursor agent | 37 | 5,966 |
| OpenAI Codex | 26 | 1,938 |
| GitHub Copilot coding agent | 3 | 502 |
- AI tooling configured in repo: cursor, generic-agent
Current source lines last changed by AI-attributed commits: 13,065 of 18,999.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 1.607 | 2.865 | 0.56x |
| Security | 0.077 | 1.517 | 0.05x |
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-06 | 822 | 38% |
| 2026-07 | 10,674 | 55% |
| 2026-08 | 14,309 | 71% |
| 2026-09 | 1,585 | 34% |
| 2026-10 | 5,585 | 71% |
| 2026-11 | 47 | 100% |
Evidence
- Claude Code: on merged branch (e162cf43ff) (c020cc856fbb)
- Claude Code: trailer 'Co-Authored-By: Claude' (f8cf688dab89)
- Claude Code: trailer 'Co-Authored-By: Claude' (504767c78f66)
- Claude Code: on merged branch (3aa72d681a) (ee56857892e4)
- Claude Code: on merged branch (3aa72d681a) (5c39748c3faa)
- Claude Code: on merged branch (8baa98f2b6) (ec93dd09476d)
- Claude Code: on merged branch (3aa72d681a) (2a40a4b24ae1)
- Claude Code: on merged branch (1d238e4510) (9bc4d8b1f985)
- Claude Code: on merged branch (56e431e254) (974bdd40da1c)
- Claude Code: trailer 'Co-Authored-By: Claude' (c9b6035c0159)
- Claude Code: trailer 'Co-Authored-By: Claude' (ecd1a254b6a2)
- Claude Code: trailer 'Co-Authored-By: Claude' (5ff7e378698c)
- Claude Code: on merged branch (3aa72d681a) (351a8ff7f2f4)
- Claude Code: on merged branch (3aa72d681a) (3ac47227f33a)
- Claude Code: on merged branch (3aa72d681a) (0b8a89325767)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.41, no CI test run detected; 29% of function code in complex or long functions; 53% duplicated lines. Weakest area: duplication.
| Area | Score |
|---|---|
| Complexity (lizard) | 41 |
| Duplication | 4 |
| Code smells (Opengrep) | 82 |
| Tests and CI | 66 |
| Documentation | 80 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 1,122; mean complexity 5.3, 90th percentile 13; 100 complex and 2 long functions
- Duplicated lines: 53.2% of 15,299 compared
- Tests: 7,841 test lines for 18,999 source lines (ratio 0.41); CI test commands: none detected; 69% of recent source commits also change tests
- Docs missing or thin: changelog
Most complex functions:
- parseArgs in skills/codex-delegate/scripts/relay.mjs: complexity 50, 103 lines
- parseArgs in skills/claude-delegate/scripts/relay.mjs: complexity 45, 97 lines
- parseArgs in skills/agy-delegate/scripts/relay.mjs: complexity 44, 90 lines
- parseArgs in skills/commandcode-delegate/scripts/relay.mjs: complexity 40, 87 lines
- parseArgs in skills/vibe-delegate/scripts/relay.mjs: complexity 40, 102 lines
Security
Security posture is strong: 10 high-severity SAST findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 87 |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | 94 |
| Posture (policy, updates, signing, lockfiles) | 40 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: dependency updates, lockfiles; missing: security policy, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/javascript.lang.security.audit.spawn-shell-true: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low] |
skills/cline-delegate/scripts/relay.mjs:549 |
| high | opengrep/javascript.lang.security.audit.spawn-shell-true: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low] |
skills/codex-delegate/scripts/relay.mjs:621 |
| high | opengrep/javascript.lang.security.audit.spawn-shell-true: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low] |
skills/commandcode-delegate/scripts/relay.mjs:381 |
| high | opengrep/javascript.lang.security.audit.spawn-shell-true: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low] |
skills/copilot-delegate/scripts/relay.mjs:544 |
| high | opengrep/javascript.lang.security.audit.spawn-shell-true: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low] |
skills/cursor-delegate/scripts/relay.mjs:548 |
| high | opengrep/javascript.lang.security.audit.spawn-shell-true: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low] |
skills/grok-delegate/scripts/relay.mjs:954 |
| high | opengrep/javascript.lang.security.audit.spawn-shell-true: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low] |
skills/mcode-delegate/scripts/relay.mjs:364 |
| high | opengrep/javascript.lang.security.audit.spawn-shell-true: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low] |
skills/opencode-delegate/scripts/relay.mjs:519 |
| high | opengrep/javascript.lang.security.audit.spawn-shell-true: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low] |
skills/pi-delegate/scripts/relay.mjs:561 |
| high | opengrep/javascript.lang.security.audit.spawn-shell-true: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low] |
skills/zcode-delegate/scripts/relay.mjs:398 |
| medium | zizmor/dependabot-cooldown: insufficient cooldown in Dependabot updates [confidence high] |
.github/dependabot.yml:3 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- readme-download-lure: gives an archive password
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 18,999; test lines: 7,841
| Language | Lines |
|---|---|
| JavaScript | 26,597 |
| C# | 178 |
| Shell | 65 |