rohitg00/pro-workflow

Claude Code learns from your corrections: self-correcting memory that compounds over 50+ sessions. Context engineering, parallel worktrees, agent teams, and 17 battle-tested skills.

https://github.com/rohitg00/pro-workflow · commit 86d5f2770bd8 · scored 2026-11-14 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/rohitg00/pro-workflow
Commit: 86d5f2770bd8e1695e40888e4242841eb7cbad4f
Generated: 2026-11-14T00:13:26+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	possible	59%	100%
Code quality	62	weak	90%	100%
Security	52	weak	85%	100%

AI provenance

Weak signals consistent with AI-assisted development.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.0%
AI tooling configured in repo: claude-code, generic-agent

Month	Lines added	Attributed to AI
2026-02	1,745	0%
2026-03	550	0%
2026-04	429	0%
2026-05	2,915	0%
2026-06	1,705	0%
2026-09	2,148	0%

Evidence

templates/split-claude-md/CLAUDE.md (claude-code configuration) (templates/sp)
templates/AGENTS.md (generic-agent configuration) (templates/AG)
templates/split-claude-md/AGENTS.md (generic-agent configuration) (templates/sp)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.20, CI runs tests; 27% of function code in complex or long functions; 8% duplicated lines. Weakest area: docs.

Area	Score
Complexity (lizard)	44
Duplication	60
Code smells (Opengrep)	50
Tests and CI	85
Documentation	40
Type safety	100
Process (Scorecard review/maintenance)	n/a

Functions: 587; mean complexity 3.2, 90th percentile 7; 15 complex and 4 long functions
Duplicated lines: 8.4% of 5,470 compared
Tests: 1,454 test lines for 7,373 source lines (ratio 0.20); CI test commands: npm test; 26% of recent source commits also change tests
Docs missing or thin: license, contributing, changelog

Most complex functions:

Security

Security posture is weak: 20 known vulnerabilities in 9 dependencies; 10 high-severity workflow issues. Weakest area: ci actions.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	18
Vulnerable dependencies (OSV)	51
CI workflows (zizmor)	14
Posture (policy, updates, signing, lockfiles)	60
OpenSSF Scorecard	n/a

Known vulnerabilities: 20 in 9 packages (critical 0, high 4, medium 12, low 4)
Posture checks passed: dependency updates, signed commits, lockfiles; missing: security policy

Top findings

Severity	Finding	Location
high	`osv/GHSA-22jm-h49p-29qw`: @modelcontextprotocol/sdk@1.31.0 (npm) is affected by GHSA-22jm-h49p-29qw	package-lock.json
high	`osv/GHSA-46jr-4wx8-v453`: @modelcontextprotocol/sdk@1.31.0 (npm) is affected by GHSA-46jr-4wx8-v453	package-lock.json
high	`osv/GHSA-27r3-jxmh-p828`: body-parser@2.3.0 (npm) is affected by GHSA-27r3-jxmh-p828	package-lock.json
high	`osv/GHSA-mrhx-c7xc-m3w5`: zod@4.6.5 (npm) is affected by GHSA-mrhx-c7xc-m3w5	package-lock.json
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:19
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:22
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:51
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/npm-publish.yml:22
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/npm-publish.yml:27
high	`zizmor/cache-poisoning`: runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]	.github/workflows/npm-publish.yml:27
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:17
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:22
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:76
high	`zizmor/cache-poisoning`: runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]	.github/workflows/release.yml:22
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	scripts/commit-validate.js:142
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`: Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]	scripts/config-watcher.js:11
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`: Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]	scripts/config-watcher.js:12
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`: Detected that function argument `chunk` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]	scripts/cwd-changed.js:13
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`: Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]	scripts/cwd-changed.js:13
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`: Detected that function argument `chunk` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]	scripts/cwd-changed.js:14
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`: Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]	scripts/cwd-changed.js:14
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`: Detected that function argument `chunk` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]	scripts/cwd-changed.js:15
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`: Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]	scripts/cwd-changed.js:15
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`: Detected that function argument `chunk` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]	scripts/cwd-changed.js:15
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`: Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]	scripts/cwd-changed.js:15

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 7,373; test lines: 1,454

Language	Lines
JavaScript	6,061
TypeScript	2,413
SQL	253
Shell	100

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/rohitg00/pro-workflow/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/rohitg00/pro-workflow/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/rohitg00/pro-workflow/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/rohitg00/pro-workflow/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/rohitg00/pro-workflow/security.svg)](https://repotrust.synapticcyber.com/r/github.com/rohitg00/pro-workflow/)