shinshin86/mesh-avatar-studio

• Repository: https://github.com/shinshin86/mesh-avatar-studio
• Commit: 6d2817aa0869365a0a5634241bf50af6bfd78a2a
• Generated: 2026-11-14T00:14:46+00:00
• Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

AI provenance

Explicit AI attribution on 69% of first-party code added; an estimated 69% including velocity signals.

• Explicitly attributed share (lower bound): 69.5%
• Unattributed share in AI-consistent velocity bursts: 4.4%
• Estimated AI-generated share: 69.5%

• AI tooling configured in repo: claude-code, generic-agent

Current source lines last changed by AI-attributed commits: 23,054 of 32,450.

• Stylometry index: 0.03 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 2). Reported as a signal, not scored.

Evidence

• Claude Code: on merged branch (c220f4eb0a) (73d6531bca88)
• Claude Code: trailer 'Co-Authored-By: Claude' (4732e76fdb52)
• Claude Code: trailer 'Co-Authored-By: Claude' (afb3e6d7dc2f)
• Claude Code: trailer 'Co-Authored-By: Claude' (571566de024a)
• Claude Code: trailer 'Co-Authored-By: Claude' (01a34e8a7987)
• Claude Code: trailer 'Co-Authored-By: Claude' (3a2eed52b46f)
• OpenAI Codex: on merged branch (fceeced452) (8263722b9874)
• OpenAI Codex: on merged branch (3af275e0b1) (58f6598d78ad)
• OpenAI Codex: on merged branch (3af275e0b1) (bcaedfad55fa)
• OpenAI Codex: on merged branch (3af275e0b1) (2ee6dd29d88e)
• OpenAI Codex: on merged branch (3af275e0b1) (f7798fd037ec)
• OpenAI Codex: on merged branch (3af275e0b1) (4c5929fcd67d)
• Claude Code: trailer 'Co-Authored-By: Claude' (1b90af02aee7)
• Claude Code: trailer 'Co-Authored-By: Claude' (f9a1542b1ba6)
• Claude Code: trailer 'Co-Authored-By: Claude' (7566e98426f5)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.33, CI runs tests; 30% of function code in complex or long functions; 11% duplicated lines. Weakest area: complexity.

• Functions: 2,648; mean complexity 3.3, 90th percentile 7; 85 complex and 28 long functions
• Duplicated lines: 10.7% of 25,956 compared
• Tests: 10,731 test lines for 32,450 source lines (ratio 0.33); CI test commands: npm test, go test, cargo test; 75% of recent source commits also change tests
• Docs missing or thin: contributing, changelog

Most complex functions:

• (anonymous) in src/server/local-projects.ts: complexity 114, 155 lines
• Workspace in src/editor/App.tsx: complexity 105, 175 lines
• update in packages/runtime/src/engine/motion.js: complexity 89, 158 lines
• update in reference/engine/motion.js: complexity 76, 138 lines
• update in native/crates/mesh-avatar-core/src/engine/motion.rs: complexity 67, 262 lines

Security

Security posture is weak: 21 known vulnerabilities in 10 dependencies; 2 high-severity SAST findings; 15 high-severity workflow issues. Weakest area: posture.

• Known vulnerabilities: 21 in 10 packages (critical 4, high 4, medium 8, low 1)

• Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles

Top findings

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

• star-burst: 2344 stars in 41 days (57/day)

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

• Source lines: 32,450; test lines: 10,731