Leaderboard github.com
oil-oil/oil-motion
Web animation skill for Claude Code & Codex. 帮你做跟着滚动和鼠标动的网页动画。
AI provenance
5%
explicit
- Confidence
- 76%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
71/100
adequate
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
73/100
adequate
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
- Repository: https://github.com/oil-oil/oil-motion
- Commit:
07e31f2265f80caa8f2c1df825d85ac24a46307c - Generated: 2026-11-14T00:12:01+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 5 | explicit | 76% | 100% |
| Code quality | 71 | adequate | 90% | 100% |
| Security | 73 | adequate | 85% | 100% |
AI provenance
Explicit AI attribution on 5% of first-party code added; an estimated 5% including velocity signals.
- Explicitly attributed share (lower bound): 4.9%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 4.9%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 2 | 494 |
Current source lines last changed by AI-attributed commits: 258 of 7,516.
Too few lines in one group to compare finding densities.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-08 | 7,951 | 0% |
| 2026-09 | 2,216 | 22% |
Evidence
- Claude Code: trailer 'Co-Authored-By: Claude' (8e4d1c3d0eab)
- Claude Code: trailer 'Co-Authored-By: Claude' (bd91c70b1158)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.30, CI runs tests; 28% of function code in complex or long functions; 1% duplicated lines. Weakest area: type safety.
| Area | Score |
|---|---|
| Complexity (lizard) | 44 |
| Duplication | 92 |
| Code smells (Opengrep) | 97 |
| Tests and CI | 80 |
| Documentation | 65 |
| Type safety | 14 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 395; mean complexity 4.2, 90th percentile 9; 12 complex and 8 long functions
- Duplicated lines: 1.3% of 5,930 compared
- Tests: 2,228 test lines for 7,516 source lines (ratio 0.30); CI test commands: npm test, unittest; 82% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- compile_motion in scripts/compile_scroll_video.py: complexity 58, 450 lines
- (anonymous) in scripts/credential-ui/src/server.ts: complexity 49, 82 lines
- build_payload in scripts/video_job.py: complexity 33, 68 lines
- command_atlas in scripts/optimize_motion.py: complexity 31, 207 lines
- analyze_directory in scripts/motion_pipeline.py: complexity 29, 150 lines
Security
Security posture is adequate: 55 known vulnerabilities in 1 dependencies; 4 high-severity SAST findings; 2 high-severity workflow issues. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 97 |
| Static analysis (Opengrep) | 82 |
| Vulnerable dependencies (OSV) | 78 |
| CI workflows (zizmor) | 65 |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 55 in 1 packages (critical 6, high 34, medium 13, low 0)
-
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-5x8w-8jj5-q52h: pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h |
scripts/requirements.txt |
| critical | osv/GHSA-8g5g-8vmr-9782: pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782 |
scripts/requirements.txt |
| critical | osv/GHSA-xvh5-g6gv-559v: pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v |
scripts/requirements.txt |
| critical | osv/GHSA-3f63-hfp8-52jq: pillow@10.0.0 (PyPI) is affected by PYSEC-2026-457, GHSA-3f63-hfp8-52jq |
scripts/requirements.txt |
| critical | osv/GHSA-332p-7hrc-92wf: pillow@10.0.0 (PyPI) is affected by GHSA-332p-7hrc-92wf |
scripts/requirements.txt |
| critical | osv/GHSA-w889-685w-c8fh: pillow@10.0.0 (PyPI) is affected by GHSA-w889-685w-c8fh |
scripts/requirements.txt |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/compile_scroll_video.py:50 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/media_edges.py:24 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/motion_pipeline.py:61 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/optimize_motion.py:41 |
| high | osv/GHSA-44wm-f244-xhp3: pillow@10.0.0 (PyPI) is affected by PYSEC-2026-1793, GHSA-44wm-f244-xhp3 |
scripts/requirements.txt |
| high | osv/GHSA-j7hp-h8jx-5ppr: pillow@10.0.0 (PyPI) is affected by PYSEC-2026-1794, GHSA-j7hp-h8jx-5ppr |
scripts/requirements.txt |
| high | osv/GHSA-8v84-f9pq-wr9x: pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2253, GHSA-8v84-f9pq-wr9x |
scripts/requirements.txt |
| high | osv/GHSA-5x94-69rx-g8h2: pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2254, GHSA-5x94-69rx-g8h2 |
scripts/requirements.txt |
| high | osv/GHSA-45hq-cxwh-f6vc: pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2255, GHSA-45hq-cxwh-f6vc |
scripts/requirements.txt |
| high | osv/GHSA-phj9-mv4w-65pm: pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2256, GHSA-phj9-mv4w-65pm |
scripts/requirements.txt |
| high | osv/GHSA-6r8x-57c9-28j4: pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3451, GHSA-6r8x-57c9-28j4 |
scripts/requirements.txt |
| high | osv/GHSA-9hw9-ch79-4vh6: pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3453, GHSA-9hw9-ch79-4vh6 |
scripts/requirements.txt |
| high | osv/GHSA-xj96-63gp-2gmr: pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3454, GHSA-xj96-63gp-2gmr |
scripts/requirements.txt |
| high | osv/GHSA-62p4-gmf7-7g93: pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3493, GHSA-62p4-gmf7-7g93 |
scripts/requirements.txt |
| high | osv/GHSA-jjj6-mw9f-p565: pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3495, GHSA-jjj6-mw9f-p565 |
scripts/requirements.txt |
| high | osv/GHSA-vjc4-5qp5-m44j: pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3496, GHSA-vjc4-5qp5-m44j |
scripts/requirements.txt |
| high | osv/GHSA-27h8-gf7j-v5hc: pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4326, GHSA-27h8-gf7j-v5hc |
scripts/requirements.txt |
| high | osv/GHSA-4558-3h8r-v8xp: pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4327, GHSA-4558-3h8r-v8xp |
scripts/requirements.txt |
| high | osv/GHSA-58r4-6rv3-gfh8: pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4329, GHSA-58r4-6rv3-gfh8 |
scripts/requirements.txt |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 7,516; test lines: 2,228
| Language | Lines |
|---|---|
| Python | 7,382 |
| TypeScript | 2,217 |
| JavaScript | 145 |