mitsuhiko/mini-presenter
- Repository: https://github.com/mitsuhiko/mini-presenter
- Commit:
8dd9a896e44d6aa5357bb293f841efb0e770b829 - Generated: 2026-11-13T23:44:14+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | possible | 61% | 100% |
| Code quality | 80 | adequate | 90% | 100% |
| Security | 70 | weak | 85% | 100% |
AI provenance
Weak signals consistent with AI-assisted development.
-
Explicitly attributed share (lower bound): 0.0%
-
Unattributed share in AI-consistent velocity bursts: 7.7%
-
Estimated AI-generated share: 0.0%
-
AI tooling configured in repo: generic-agent
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-01 | 8,197 | 0% |
| 2026-03 | 3,225 | 0% |
| 2026-04 | 106 | 0% |
| 2026-11 | 8,748 | 0% |
Evidence
- AGENTS.md (generic-agent configuration) (AGENTS.md)
- 1,553 lines of first-party code in ~1.4h (1,099 lines/hour, 3 commit session) (72c577f5ee78)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.08, CI runs tests; 10% of function code in complex or long functions; 0% duplicated lines. Weakest area: testing.
| Area | Score |
|---|---|
| Complexity (lizard) | 74 |
| Duplication | 100 |
| Code smells (Opengrep) | 88 |
| Tests and CI | 61 |
| Documentation | 85 |
| Type safety | 100 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 805; mean complexity 2.6, 90th percentile 6; 5 complex and 3 long functions
- Duplicated lines: 0.0% of 5,928 compared
- Tests: 618 test lines for 8,128 source lines (ratio 0.08); CI test commands: npm test; 5% of recent source commits also change tests
- Docs missing or thin: contributing
Most complex functions:
- compute in src/client/presenter/timer.ts: complexity 35, 65 lines
- SettingsDialog in src/client/presenter/components/SettingsDialog.tsx: complexity 19, 211 lines
- onKeyDown in src/client/presenter/index.tsx: complexity 18, 40 lines
- captureAll in src/export/export.ts: complexity 17, 48 lines
- runExport in src/cli.ts: complexity 16, 53 lines
Security
Security posture is weak: 2 known vulnerabilities in 1 dependencies; 2 high-severity SAST findings; 5 high-severity workflow issues. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 72 |
| Vulnerable dependencies (OSV) | 88 |
| CI workflows (zizmor) | 39 |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 2 in 1 packages (critical 0, high 1, medium 1, low 0)
-
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
src/client/display/overlay.ts:88 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a shadow.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
src/client/display/overlay.ts:88 |
| high | osv/GHSA-96hv-2xvq-fx4p: ws@8.19.0 (npm) is affected by GHSA-96hv-2xvq-fx4p |
package-lock.json |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:15 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:18 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/publish.yml:15 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/publish.yml:18 |
| high | zizmor/cache-poisoning: runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] |
.github/workflows/publish.yml:18 |
| medium | opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] |
src/client/display/overlay.ts:65 |
| medium | opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] |
src/client/display/overlay.ts:88 |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] |
src/client/display/overlay.ts:107 |
| medium | opengrep/javascript.browser.security.wildcard-postmessage-configuration: The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. [confidence medium] |
src/client/display/preview.ts:54 |
| medium | opengrep/javascript.browser.security.wildcard-postmessage-configuration: The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. [confidence medium] |
src/client/presenter/components/PreviewFrame.tsx:69 |
| medium | opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] |
src/client/presenter/index.tsx:35 |
| medium | opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] |
src/client/presenter/index.tsx:37 |
| medium | opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] |
src/client/standalone.ts:74 |
| medium | opengrep/javascript.browser.security.raw-html-concat: User controlled data in a HTML string may result in XSS [confidence medium] |
src/client/standalone.ts:74 |
| medium | opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] |
src/client/standalone.ts:75 |
| medium | opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] |
src/client/standalone.ts:76 |
| medium | opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] |
src/client/standalone.ts:84 |
| medium | opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] |
src/client/standalone.ts:85 |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] |
src/client/ui/icons.tsx:121 |
| medium | opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] |
src/server/inject.ts:3 |
| medium | opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] |
src/server/inject.ts:19 |
| medium | opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] |
src/server/inject.ts:20 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 8,128; test lines: 618
| Language | Lines |
|---|---|
| TypeScript | 8,729 |
| JavaScript | 17 |