RepoTrust

Leaderboard github.com

soumatheusgomes/vibe-coding-toolkit

A curated, battle-tested AI-coding toolkit: Claude Code plugins, subagent orchestration, quality gates, and ready-to-copy prompts, extracted from real production use.

  • View repository ↗
  • JavaScript
  • ★ 2,414
  • commit 7ef68dd7b00d
  • scored 2026-11-14
  • scoring prov-4+qual-2+sec-2

AI provenance

42%

explicit

Confidence
79%
Coverage
100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

75/100

adequate

Confidence
90%
Coverage
100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

84/100

adequate

Confidence
85%
Coverage
100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON RepoTrust ai badgeRepoTrust quality badgeRepoTrust security badge

Scores

Pillar Score Signal Confidence Coverage
AI provenance (estimated AI-generated share) 42 explicit 79% 100%
Code quality 75 adequate 90% 100%
Security 84 adequate 85% 100%

AI provenance

Explicit AI attribution on 42% of first-party code added; an estimated 42% including velocity signals.

  • Explicitly attributed share (lower bound): 42.3%
  • Unattributed share in AI-consistent velocity bursts: 0.0%
  • Estimated AI-generated share: 42.3%
AI tool Attributed commits Lines added
Claude Code 14 554
  • AI tooling configured in repo: claude-code, generic-agent

Current source lines last changed by AI-attributed commits: 539 of 1,098.

Findings per 1,000 lines AI-attributed Other Ratio
Quality 0.0 7.156 0.0x
Security 0.0 1.789 0.0x
Month Lines added Attributed to AI
2026-09 554 100%
2026-10 757 0%

Evidence

  • Claude Code: trailer 'Co-Authored-By: Claude' (13add2119446)
  • Claude Code: trailer 'Co-Authored-By: Claude' (654589f550bd)
  • Claude Code: trailer 'Co-Authored-By: Claude' (e4a6ff19d570)
  • Claude Code: trailer 'Co-Authored-By: Claude' (e0ef16d4445f)
  • Claude Code: trailer 'Co-Authored-By: Claude' (ebd21d3febfb)
  • Claude Code: trailer 'Co-Authored-By: Claude' (a9aa6bc1179c)
  • Claude Code: trailer 'Co-Authored-By: Claude' (b603274955ad)
  • Claude Code: trailer 'Co-Authored-By: Claude' (c871a94f2051)
  • Claude Code: trailer 'Co-Authored-By: Claude' (9d4234f471de)
  • Claude Code: trailer 'Co-Authored-By: Claude' (7b28a6dbdd3d)
  • Claude Code: trailer 'Co-Authored-By: Claude' (eef2723d928c)
  • Claude Code: trailer 'Co-Authored-By: Claude' (e10596fd0f7b)
  • Claude Code: trailer 'Co-Authored-By: Claude' (066ae033ced6)
  • Claude Code: trailer 'Co-Authored-By: Claude' (61dbf243bc01)
  • CLAUDE.md (claude-code configuration) (CLAUDE.md)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.11, no CI test run detected; 0% of function code in complex or long functions; 1% duplicated lines. Weakest area: testing.

Area Score
Complexity (lizard) 100
Duplication 92
Code smells (Opengrep) 80
Tests and CI 48
Documentation 65
Type safety n/a
Process (Scorecard review/maintenance) n/a
  • Functions: 67; mean complexity 2.1, 90th percentile 5; 0 complex and 0 long functions
  • Duplicated lines: 1.5% of 809 compared
  • Tests: 121 test lines for 1,098 source lines (ratio 0.11); CI test commands: none detected; 18% of recent source commits also change tests
  • Docs missing or thin: contributing, changelog

Security

Security posture is adequate: no high-impact findings. Weakest area: posture.

Area Score
Secrets (gitleaks, tree + history) 100
Static analysis (Opengrep) 92
Vulnerable dependencies (OSV) n/a
CI workflows (zizmor) 100
Posture (policy, updates, signing, lockfiles) 0
OpenSSF Scorecard n/a
  • Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity Finding Location
medium opengrep/javascript.lang.security.insecure-object-assign: Depending on the context, user control data in Object.assign can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low] scripts/validate-next.mjs:245

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

  • Source lines: 1,098; test lines: 121
Language Lines
JavaScript 1,219

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/soumatheusgomes/vibe-coding-toolkit/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/soumatheusgomes/vibe-coding-toolkit/)
[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/soumatheusgomes/vibe-coding-toolkit/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/soumatheusgomes/vibe-coding-toolkit/)
[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/soumatheusgomes/vibe-coding-toolkit/security.svg)](https://repotrust.synapticcyber.com/r/github.com/soumatheusgomes/vibe-coding-toolkit/)