folke/sidekick.nvim
Your Neovim AI sidekick
- Repository: https://github.com/folke/sidekick.nvim
- Commit:
3d80a47e6375f6d647c9695d3afea6fa1b3275df - Generated: 2026-11-14T00:05:45+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | possible | 65% | 100% |
| Code quality | 76 | adequate | 74% | 100% |
| Security | 67 | weak | 85% | 100% |
AI provenance
Weak signals consistent with AI-assisted development.
-
Explicitly attributed share (lower bound): 0.0%
-
Unattributed share in AI-consistent velocity bursts: 0.0%
-
Estimated AI-generated share: 0.0%
-
AI tooling configured in repo: generic-agent
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-09 | 4,873 | 0% |
| 2025-10 | 7,092 | 0% |
| 2026-03 | 125 | 0% |
| 2026-04 | 13 | 0% |
| 2026-09 | 56 | 0% |
Evidence
- AGENTS.md (generic-agent configuration) (AGENTS.md)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.38, no CI test run detected; 0% duplicated lines. Weakest area: testing.
| Area | Score |
|---|---|
| Complexity (lizard) | n/a |
| Duplication | 100 |
| Code smells (Opengrep) | n/a |
| Tests and CI | 57 |
| Documentation | 85 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Duplicated lines: 0.0% of 4,364 compared
- Tests: 2,296 test lines for 6,045 source lines (ratio 0.38); CI test commands: none detected; 8% of recent source commits also change tests
- Docs missing or thin: contributing
Security
Security posture is weak: 7 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | n/a |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | 16 |
| Posture (policy, updates, signing, lockfiles) | 60 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: dependency updates, signed commits, lockfiles; missing: security policy
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:10 |
| high | zizmor/dangerous-triggers: use of fundamentally insecure workflow trigger [confidence medium] |
.github/workflows/labeler.yml:3 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/labeler.yml:7 |
| high | zizmor/dangerous-triggers: use of fundamentally insecure workflow trigger [confidence medium] |
.github/workflows/pr.yml:4 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/pr.yml:17 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/stale.yml:10 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/update.yml:12 |
| medium | zizmor/dependabot-cooldown: insufficient cooldown in Dependabot updates [confidence high] |
.github/dependabot.yml:3 |
| medium | zizmor/excessive-permissions: overly broad permissions [confidence medium] |
.github/workflows/ci.yml:9 |
| medium | zizmor/secrets-inherit: secrets unconditionally inherited by called workflow [confidence high] |
.github/workflows/ci.yml:10 |
| medium | zizmor/excessive-permissions: overly broad permissions [confidence medium] |
.github/workflows/labeler.yml:6 |
| medium | zizmor/secrets-inherit: secrets unconditionally inherited by called workflow [confidence high] |
.github/workflows/labeler.yml:7 |
| medium | zizmor/secrets-inherit: secrets unconditionally inherited by called workflow [confidence high] |
.github/workflows/pr.yml:17 |
| medium | zizmor/excessive-permissions: overly broad permissions [confidence medium] |
.github/workflows/stale.yml:8 |
| medium | zizmor/secrets-inherit: secrets unconditionally inherited by called workflow [confidence high] |
.github/workflows/stale.yml:10 |
| medium | zizmor/excessive-permissions: overly broad permissions [confidence medium] |
.github/workflows/update.yml:10 |
| medium | zizmor/secrets-inherit: secrets unconditionally inherited by called workflow [confidence high] |
.github/workflows/update.yml:12 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 6,045; test lines: 2,296
| Language | Lines |
|---|---|
| Lua | 8,341 |