kirarpit/plexwrap

• Repository: https://github.com/kirarpit/plexwrap
• Commit: 2a751066a8aef2bd936e4a32597ee835f01aec29
• Generated: 2026-11-13T23:55:11+00:00
• Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

AI provenance

Explicit AI attribution on 2% of first-party code added; an estimated 2% including velocity signals.

• Explicitly attributed share (lower bound): 1.6%
• Unattributed share in AI-consistent velocity bursts: 0.0%
• Estimated AI-generated share: 1.6%

• AI tooling configured in repo: claude-code

Current source lines last changed by AI-attributed commits: 108 of 7,704.

Too few lines in one group to compare finding densities.

• Stylometry index: 4.80 per 1,000 lines (narrated steps 1, placeholders 0, assistant phrasing 0, emoji 72). Reported as a signal, not scored.

Evidence

• Claude Code: on merged branch (89cbb29f58) (55060dc21332)
• Claude Code: author claude[bot] (ddfe48713472)
• .github/workflows/claude.yml runs anthropics/claude-code-action (.github/work)
• step-by-step narration comment: // First, get the image modification time for cache-busting (frontend/src)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.00, CI runs tests; 33% of function code in complex or long functions; 5% duplicated lines. Weakest area: type safety.

• Functions: 268; mean complexity 5.7, 90th percentile 12; 14 complex and 7 long functions
• Duplicated lines: 4.6% of 5,696 compared
• Tests: 9 test lines for 7,704 source lines (ratio 0.00); CI test commands: npm run test; 7% of recent source commits also change tests
• Docs missing or thin: license, contributing, changelog

Most complex functions:

• analyze_history in analyzer.py: complexity 141, 363 lines
• get_user_comparative_stats in cross_user_analyzer.py: complexity 72, 255 lines
• (anonymous) in frontend/src/components/cards/CardFactory.tsx: complexity 29, 126 lines
• SummaryCard in frontend/src/components/cards/SummaryCard.tsx: complexity 28, 152 lines
• _extract_images_from_response in clients/image_client.py: complexity 24, 54 lines

Security

Security posture is weak: 189 known vulnerabilities in 57 dependencies; 3 high-severity workflow issues. Weakest area: posture.

• Known vulnerabilities: 189 in 57 packages (critical 4, high 92, medium 78, low 15)

• Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles

Top findings

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

• Source lines: 7,704; test lines: 9

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/kirarpit/plexwrap/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/kirarpit/plexwrap/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/kirarpit/plexwrap/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/kirarpit/plexwrap/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/kirarpit/plexwrap/security.svg)](https://repotrust.synapticcyber.com/r/github.com/kirarpit/plexwrap/)