bryan-uipath/ottobot

Higher-order coding agent: trigger-bearing skills → scheduled/event-driven claude runs, with a TUI

https://github.com/bryan-uipath/ottobot · commit 7366dd3d1411 · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

unreviewed-ai-risk

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/bryan-uipath/ottobot
Commit: 7366dd3d1411719d18acf5c91f6075d2388f7112
Generated: 2026-11-13T23:19:10+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Unreviewed AI code risk: a large share of this code is explicitly AI-attributed, and its tests or review process are weak while quality or security scores are low.

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	95	explicit	74%	100%
Code quality	67	adequate	90%	100%
Security	66	weak	85%	100%

AI provenance

Explicit AI attribution on 95% of first-party code added; an estimated 95% including velocity signals.

Explicitly attributed share (lower bound): 95.1%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 95.1%

AI tool	Attributed commits	Lines added
Claude Code	17	7,170

Current source lines last changed by AI-attributed commits: 6,519 of 6,859.

Too few lines in one group to compare finding densities.

Stylometry index: 0.36 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 5). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2026-09	1,831	80%
2026-10	5,706	100%

Evidence

Claude Code: trailer 'Co-authored-by: Claude' (7366dd3d1411)
Claude Code: trailer 'Co-Authored-By: Claude' (1abeee5659b3)
Claude Code: trailer 'Co-Authored-By: Claude' (6b699bb32550)
Claude Code: trailer 'Co-Authored-By: Claude' (d906de0b8696)
Claude Code: trailer 'Co-Authored-By: Claude' (9693501223bd)
Claude Code: trailer 'Co-Authored-By: Claude' (c2ff801f8e07)
Claude Code: trailer 'Co-Authored-By: Claude' (f87fe7a1598c)
Claude Code: trailer 'Co-Authored-By: Claude' (e571148f18ff)
Claude Code: trailer 'Co-Authored-By: Claude' (23220d80e090)
Claude Code: trailer 'Co-Authored-By: Claude' (0c340abd52c0)
Claude Code: trailer 'Co-Authored-By: Claude' (19d527e84205)
Claude Code: trailer 'Co-Authored-By: Claude' (d403579d0f78)
Claude Code: PR description attribution (26fa3970221d)
Claude Code: trailer 'Co-Authored-By: Claude' (813d79b64c1c)
Claude Code: trailer 'Co-Authored-By: Claude' (438c6b3cc4d9)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.00, CI runs tests; 18% of function code in complex or long functions; 3% duplicated lines. Weakest area: testing.

Area	Score
Complexity (lizard)	58
Duplication	85
Code smells (Opengrep)	100
Tests and CI	45
Documentation	60
Type safety	n/a
Process (Scorecard review/maintenance)	n/a

Functions: 341; mean complexity 4.0, 90th percentile 9; 10 complex and 3 long functions
Duplicated lines: 2.6% of 5,073 compared
Tests: 0 test lines for 6,859 source lines (ratio 0.00); CI test commands: go test, cargo test; 0% of recent source commits also change tests
Docs missing or thin: license, contributing

Most complex functions:

Security

Security posture is weak: 11 known vulnerabilities in 10 dependencies; 7 high-severity workflow issues. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	88
Vulnerable dependencies (OSV)	56
CI workflows (zizmor)	23
Posture (policy, updates, signing, lockfiles)	20
OpenSSF Scorecard	n/a

Known vulnerabilities: 11 in 10 packages (critical 0, high 1, medium 1, low 1)
Posture checks passed: signed commits; missing: security policy, dependency updates, lockfiles

Top findings

Severity	Finding	Location
high	`osv/RUSTSEC-2026-0433`: pulldown-cmark@0.13.5 (crates.io) is affected by RUSTSEC-2026-0433	Cargo.lock
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:23
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:23
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:41
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:58
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:73
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:91
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:102
medium	`osv/RUSTSEC-2026-0253`: lru@0.12.5 (crates.io) is affected by RUSTSEC-2026-0253	Cargo.lock
medium	`osv/RUSTSEC-2024-0436`: paste@1.0.15 (crates.io) is affected by RUSTSEC-2024-0436	Cargo.lock
medium	`osv/RUSTSEC-2026-0386`: tokio@1.53.1 (crates.io) is affected by RUSTSEC-2026-0386	Cargo.lock
medium	`osv/RUSTSEC-2024-0449`: unsafe-libyaml@0.2.11 (crates.io) is affected by RUSTSEC-2024-0449	Cargo.lock
medium	`osv/GHSA-wrw7-89jp-8q8g`: glib@0.18.5 (crates.io) is affected by RUSTSEC-2024-0429, GHSA-wrw7-89jp-8q8g	tray/src-tauri/Cargo.lock
medium	`osv/RUSTSEC-2024-0370`: proc-macro-error@1.0.4 (crates.io) is affected by RUSTSEC-2024-0370	tray/src-tauri/Cargo.lock
medium	`osv/RUSTSEC-2026-0371`: zbus_names@4.3.5 (crates.io) is affected by RUSTSEC-2026-0371	tray/src-tauri/Cargo.lock
medium	`osv/RUSTSEC-2026-0370`: zvariant@5.15.1 (crates.io) is affected by RUSTSEC-2026-0370	tray/src-tauri/Cargo.lock
medium	`osv/RUSTSEC-2026-0372`: zvariant_derive@5.15.1 (crates.io) is affected by RUSTSEC-2026-0372	tray/src-tauri/Cargo.lock
medium	`zizmor/artipacked`: credential persistence through GitHub Actions artifacts [confidence low]	.github/workflows/ci.yml:23
medium	`zizmor/artipacked`: credential persistence through GitHub Actions artifacts [confidence low]	.github/workflows/release.yml:23
medium	`zizmor/artipacked`: credential persistence through GitHub Actions artifacts [confidence low]	.github/workflows/release.yml:41
medium	`zizmor/artipacked`: credential persistence through GitHub Actions artifacts [confidence low]	.github/workflows/release.yml:73
low	`opengrep/rust.lang.security.unsafe-usage`: Detected 'unsafe' usage, please audit for secure usage [confidence high]	src/daemon.rs:89
low	`opengrep/rust.lang.security.current-exe`: current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change the output arbitrarily." [confidence high]	src/daemon.rs:142
low	`opengrep/rust.lang.security.temp-dir`: temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary directory must use a secure method to create a uniquely named file. [confidence high]	src/ledger.rs:80
low	`opengrep/rust.lang.security.temp-dir`: temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary directory must use a secure method to create a uniquely named file. [confidence high]	src/state.rs:317

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 6,859; test lines: 0

Language	Lines
Rust	6,472
JavaScript	205
Shell	182

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/bryan-uipath/ottobot/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/bryan-uipath/ottobot/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/bryan-uipath/ottobot/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/bryan-uipath/ottobot/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/bryan-uipath/ottobot/security.svg)](https://repotrust.synapticcyber.com/r/github.com/bryan-uipath/ottobot/)