caru-ini/stack-diagram

Agent skill: describe your stack in a sentence, get an architecture diagram with official logos

https://github.com/caru-ini/stack-diagram · commit 9175bde8449c · scored 2026-11-14 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/caru-ini/stack-diagram
Commit: 9175bde8449cc8f5390d6eb72ecc2e1f5bfe21f3
Generated: 2026-11-14T00:03:09+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	98	explicit	78%	100%
Code quality	72	adequate	90%	100%
Security	74	adequate	85%	100%

AI provenance

Explicit AI attribution on 98% of first-party code added; an estimated 98% including velocity signals.

Explicitly attributed share (lower bound): 98.3%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 98.3%

AI tool	Attributed commits	Lines added
Claude Code	27	24,342

AI tooling configured in repo: generic-agent

Current source lines last changed by AI-attributed commits: 22,566 of 22,952.

Too few lines in one group to compare finding densities.

Month	Lines added	Attributed to AI
2026-11	24,764	98%

Evidence

Claude Code: trailer 'Co-Authored-By: Claude' (5af3b095fff7)
Claude Code: trailer 'Co-Authored-By: Claude' (1ed53e3e9525)
Claude Code: trailer 'Co-Authored-By: Claude' (30cbbb76d308)
Claude Code: trailer 'Co-Authored-By: Claude' (9e90a3b286ba)
Claude Code: trailer 'Co-Authored-By: Claude' (9413ef2b611b)
Claude Code: trailer 'Co-Authored-By: Claude' (aa06ba71333c)
Claude Code: trailer 'Co-Authored-By: Claude' (b5d3f57cc49f)
Claude Code: trailer 'Co-Authored-By: Claude' (2801faea2b15)
Claude Code: trailer 'Co-Authored-By: Claude' (12f1e07bbeda)
Claude Code: trailer 'Co-Authored-By: Claude' (c01b08ccd30c)
Claude Code: trailer 'Co-Authored-By: Claude' (b3087832df1b)
Claude Code: trailer 'Co-Authored-By: Claude' (05dfbee0f59b)
Claude Code: trailer 'Co-Authored-By: Claude' (222a87f625b6)
Claude Code: trailer 'Co-Authored-By: Claude' (0ac006d7d532)
Claude Code: trailer 'Co-Authored-By: Claude' (a65fbd071e8b)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.07, CI runs tests; 4% of function code in complex or long functions; 13% duplicated lines. Weakest area: duplication.

Area	Score
Complexity (lizard)	88
Duplication	45
Code smells (Opengrep)	88
Tests and CI	65
Documentation	65
Type safety	98
Process (Scorecard review/maintenance)	n/a

Functions: 914; mean complexity 1.8, 90th percentile 4; 4 complex and 0 long functions
Duplicated lines: 13.4% of 15,530 compared
Tests: 1,534 test lines for 22,952 source lines (ratio 0.07); CI test commands: npm test, pnpm test; 18% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is adequate: 4 known vulnerabilities in 4 dependencies; 7 high-severity workflow issues. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	98
Vulnerable dependencies (OSV)	82
CI workflows (zizmor)	24
Posture (policy, updates, signing, lockfiles)	20
OpenSSF Scorecard	n/a

Known vulnerabilities: 4 in 4 packages (critical 0, high 0, medium 4, low 0)
Posture checks passed: signed commits, lockfiles; missing: security policy, dependency updates

Top findings

Severity	Finding	Location
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:14
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/site.yml:21
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/site.yml:22
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/site.yml:25
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/site.yml:46
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/site.yml:47
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/site.yml:50
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	site/src/features/admin/moderation.ts:21
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`: RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]	site/src/features/submit/server/icons.ts:60
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`: Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]	skills/stack-diagram/scripts/fetch_icons.py:203
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`: Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]	skills/stack-diagram/scripts/share.py:41
medium	`osv/GHSA-67mh-4wv8-2f99`: esbuild@0.18.20 (npm) is affected by GHSA-67mh-4wv8-2f99	site/pnpm-lock.yaml
medium	`osv/GHSA-3g3m-2fjr-6pw4`: glob@10.5.0 (npm) is affected by GHSA-3g3m-2fjr-6pw4	site/pnpm-lock.yaml
medium	`osv/GHSA-g3hv-75wg-m249`: minimatch@9.0.9 (npm) is affected by GHSA-g3hv-75wg-m249	site/pnpm-lock.yaml
medium	`osv/GHSA-wx4j-mvgx-mqwp`: satori@0.32.0 (npm) is affected by GHSA-wx4j-mvgx-mqwp	site/pnpm-lock.yaml
low	`zizmor/artipacked`: credential persistence through GitHub Actions artifacts [confidence low]	.github/workflows/release.yml:14
low	`zizmor/artipacked`: credential persistence through GitHub Actions artifacts [confidence low]	.github/workflows/site.yml:21
low	`zizmor/artipacked`: credential persistence through GitHub Actions artifacts [confidence low]	.github/workflows/site.yml:46

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

binary-release-asset: release v0.6.0 ships stack-diagram.zip (15 downloads)
binary-release-asset: release v0.5.0 ships stack-diagram.zip (19 downloads)
binary-release-asset: release v0.4.0 ships stack-diagram.zip (280 downloads)
binary-release-asset: release v0.3.0 ships stack-diagram.zip (77 downloads)
binary-release-asset: release v0.2.0 ships stack-diagram.zip (33 downloads)
star-burst: 2481 stars in 13 days (194/day)

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Source lines: 22,952; test lines: 1,534

Language	Lines
TypeScript	23,574
Python	845
SQL	67

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/caru-ini/stack-diagram/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/caru-ini/stack-diagram/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/caru-ini/stack-diagram/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/caru-ini/stack-diagram/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/caru-ini/stack-diagram/security.svg)](https://repotrust.synapticcyber.com/r/github.com/caru-ini/stack-diagram/)