digitalsamba/claude-code-video-toolkit
Make videos with Claude Code: script, AI voiceover, music, video clips and render, on open-source models that cost cents
- Repository: https://github.com/digitalsamba/claude-code-video-toolkit
- Commit:
9b0c90d421d2ab32ce8e7522494bddfe185f8aa4 - Generated: 2026-11-14T00:06:27+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 96 | explicit | 95% | 100% |
| Code quality | 60 | weak | 90% | 100% |
| Security | 50 | poor | 85% | 100% |
AI provenance
Explicit AI attribution on 96% of first-party code added; an estimated 96% including velocity signals.
- Explicitly attributed share (lower bound): 96.2%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 96.2%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 371 | 94,030 |
- AI tooling configured in repo: claude-code
Current source lines last changed by AI-attributed commits: 70,869 of 73,421.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.833 | 0.392 | 2.12x |
| Security | 1.524 | 0.0 | n/a |
- Stylometry index: 0.50 per 1,000 lines (narrated steps 20, placeholders 0, assistant phrasing 0, emoji 33). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-12 | 25,963 | 100% |
| 2026-01 | 5,019 | 100% |
| 2026-02 | 7,052 | 96% |
| 2026-03 | 12,162 | 97% |
| 2026-04 | 4,303 | 100% |
| 2026-05 | 3,419 | 84% |
| 2026-06 | 2,351 | 100% |
| 2026-08 | 8,403 | 91% |
| 2026-09 | 132 | 100% |
| 2026-10 | 13,594 | 87% |
| 2026-11 | 15,310 | 100% |
Evidence
- Claude Code: trailer 'Co-Authored-By: Claude' (bb200e2188a0)
- Claude Code: trailer 'Co-Authored-By: Claude' (cf52b1662857)
- Claude Code: trailer 'Co-Authored-By: Claude' (6b8d6054fca2)
- Claude Code: trailer 'Co-Authored-By: Claude' (43508db7ed58)
- Claude Code: trailer 'Co-Authored-By: Claude' (b6b16e33ce1d)
- Claude Code: trailer 'Co-Authored-By: Claude' (0803d6023533)
- Claude Code: trailer 'Co-Authored-By: Claude' (7361f9890534)
- Claude Code: trailer 'Co-Authored-By: Claude' (5b99d27dfd21)
- Claude Code: trailer 'Co-Authored-By: Claude' (55cf341f8123)
- Claude Code: trailer 'Co-Authored-By: Claude' (d2d0020623f2)
- Claude Code: trailer 'Co-Authored-By: Claude' (5a18845407c2)
- Claude Code: trailer 'Co-Authored-By: Claude' (d99bb6f474f7)
- Claude Code: trailer 'Co-Authored-By: Claude' (e09372917bb1)
- Claude Code: trailer 'Co-Authored-By: Claude' (a47fccbecbac)
- Claude Code: trailer 'Co-Authored-By: Claude' (14542c747a65)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.06, CI runs tests; 35% of function code in complex or long functions; 24% duplicated lines. Weakest area: duplication.
| Area | Score |
|---|---|
| Complexity (lizard) | 34 |
| Duplication | 24 |
| Code smells (Opengrep) | 82 |
| Tests and CI | 78 |
| Documentation | 80 |
| Type safety | 66 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 2,155; mean complexity 4.8, 90th percentile 11; 123 complex and 74 long functions
- Duplicated lines: 23.8% of 56,497 compared
- Tests: 4,142 test lines for 73,421 source lines (ratio 0.06); CI test commands: unittest; 29% of recent source commits also change tests
- Docs missing or thin: changelog
Most complex functions:
- main in tools/voiceover.py: complexity 122, 443 lines
- normalize_spec in tools/video_job.py: complexity 115, 182 lines
- main in tools/dewatermark.py: complexity 91, 383 lines
- main in tools/music_gen.py: complexity 78, 372 lines
- _main in tools/video_job.py: complexity 71, 175 lines
Security
Security posture is poor: 162 known vulnerabilities in 18 dependencies; 72 high-severity SAST findings; 38 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 69 |
| Vulnerable dependencies (OSV) | 10 |
| CI workflows (zizmor) | 0 |
| Posture (policy, updates, signing, lockfiles) | 40 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 162 in 18 packages (critical 14, high 87, medium 54, low 4)
-
Posture checks passed: dependency updates, lockfiles; missing: security policy, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-5x8w-8jj5-q52h: pillow@10.0 (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h |
tools/requirements.txt |
| critical | osv/GHSA-8g5g-8vmr-9782: pillow@10.0 (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782 |
tools/requirements.txt |
| critical | osv/GHSA-xvh5-g6gv-559v: pillow@10.0 (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v |
tools/requirements.txt |
| critical | osv/GHSA-3f63-hfp8-52jq: pillow@10.0 (PyPI) is affected by PYSEC-2026-457, GHSA-3f63-hfp8-52jq |
tools/requirements.txt |
| critical | osv/GHSA-332p-7hrc-92wf: pillow@10.0 (PyPI) is affected by GHSA-332p-7hrc-92wf |
tools/requirements.txt |
| critical | osv/GHSA-w889-685w-c8fh: pillow@10.0 (PyPI) is affected by GHSA-w889-685w-c8fh |
tools/requirements.txt |
| critical | osv/GHSA-82r6-8w77-94w6: anyio@4.13.0 (PyPI) is affected by PYSEC-2026-4025, GHSA-82r6-8w77-94w6 |
uv.lock |
| critical | osv/GHSA-6q48-6c7w-9gw2: certifi@2026.5.20 (PyPI) is affected by PYSEC-2026-4320, GHSA-6q48-6c7w-9gw2 |
uv.lock |
| critical | osv/GHSA-5x8w-8jj5-q52h: pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h |
uv.lock |
| critical | osv/GHSA-8g5g-8vmr-9782: pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782 |
uv.lock |
| critical | osv/GHSA-v9pv-5gc8-w2m6: pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4339, GHSA-v9pv-5gc8-w2m6 |
uv.lock |
| critical | osv/GHSA-xvh5-g6gv-559v: pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v |
uv.lock |
| critical | osv/GHSA-332p-7hrc-92wf: pillow@11.3.0 (PyPI) is affected by GHSA-332p-7hrc-92wf |
uv.lock |
| critical | osv/GHSA-w889-685w-c8fh: pillow@11.3.0 (PyPI) is affected by GHSA-w889-685w-c8fh |
uv.lock |
| high | opengrep/python.django.security.injection.ssrf.ssrf-injection-requests: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer secur [confidence medium] |
docker/modal-ltx2/app.py:591 |
| high | opengrep/python.django.security.injection.ssrf.ssrf-injection-requests: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer secur [confidence medium] |
docker/modal-propainter/app.py:88 |
| high | opengrep/python.django.security.injection.ssrf.ssrf-injection-requests: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer secur [confidence medium] |
docker/modal-propainter/app.py:90 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
docker/modal-propainter/app.py:201 |
| high | opengrep/python.django.security.injection.ssrf.ssrf-injection-requests: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer secur [confidence medium] |
docker/modal-sadtalker/app.py:151 |
| high | opengrep/python.django.security.injection.ssrf.ssrf-injection-requests: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer secur [confidence medium] |
docker/modal-sadtalker/app.py:153 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
docker/modal-sadtalker/app.py:276 |
| high | opengrep/python.django.security.injection.ssrf.ssrf-injection-requests: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer secur [confidence medium] |
docker/modal-upscale/app.py:143 |
| high | opengrep/dockerfile.security.missing-user: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
docker/runpod-propainter/Dockerfile:80 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
docker/runpod-propainter/handler.py:417 |
| high | opengrep/dockerfile.security.missing-user: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
docker/runpod-qwen3-tts/Dockerfile:54 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 73,421; test lines: 4,142
| Language | Lines |
|---|---|
| Python | 44,863 |
| TypeScript | 31,173 |
| JavaScript | 1,511 |
| Shell | 16 |