code-yeongyu/go-claude-code-comment-checker

• Repository: https://github.com/code-yeongyu/go-claude-code-comment-checker
• Commit: 311565fc9380579449ae34a8ab4c2cd386da840c
• Generated: 2026-11-13T23:58:52+00:00
• Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

AI provenance

Weak signals consistent with AI-assisted development.

• Explicitly attributed share (lower bound): 0.0%

• Unattributed share in AI-consistent velocity bursts: 34.9%

• Estimated AI-generated share: 0.0%

• AI tooling configured in repo: generic-agent

• Stylometry index: 0.65 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 4). Reported as a signal, not scored.

Evidence

• AGENTS.md (generic-agent configuration) (AGENTS.md)
• 2,396 lines of first-party code in ~4.0h (598 lines/hour, 2 commit session) (b3640433b08b)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 1.02, CI runs tests; 24% of function code in complex or long functions; 7% duplicated lines. Weakest area: complexity.

• Functions: 114; mean complexity 3.8, 90th percentile 8; 5 complex and 1 long functions
• Duplicated lines: 6.6% of 2,189 compared
• Tests: 3,115 test lines for 3,059 source lines (ratio 1.02); CI test commands: go test, cargo test; 59% of recent source commits also change tests
• Docs missing or thin: contributing, changelog

Most complex functions:

• GetLanguage in go/pkg/core/language_registry.go: complexity 32, 68 lines
• language_name_for_alias in src/language.rs: complexity 32, 37 lines
• is_english_agent_memo in src/filters.rs: complexity 30, 65 lines
• install in npm/comment-checker/postinstall.js: complexity 23, 54 lines
• run in go/cmd/comment-checker/main.go: complexity 16, 91 lines

Security

Security posture is weak: 27 known vulnerabilities in 12 dependencies; 31 high-severity workflow issues. Weakest area: posture.

• Known vulnerabilities: 27 in 12 packages (critical 0, high 0, medium 3, low 2)

• Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles

Top findings

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

• binary-release-asset: release v0.8.2 ships comment-checker_v0.8.2_darwin_amd64.tar.gz (10 downloads)
• binary-release-asset: release v0.8.2 ships comment-checker_v0.8.2_darwin_arm64.tar.gz (649 downloads)
• binary-release-asset: release v0.8.2 ships comment-checker_v0.8.2_linux_amd64.tar.gz (10105 downloads)
• binary-release-asset: release v0.8.2 ships comment-checker_v0.8.2_linux_arm64.tar.gz (929 downloads)
• binary-release-asset: release v0.8.2 ships comment-checker_v0.8.2_windows_amd64.zip (2445 downloads)
• readme-download-lure: gives an archive password

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

• Source lines: 3,059; test lines: 3,115