tj-smith47/shelly-cli
馃 Cobra CLI tool for Shelly IoT devices.
- Repository: https://github.com/tj-smith47/shelly-cli
- Commit:
593a9e2bfbb9e436f4830a64d8270dc86239d698 - Generated: 2026-11-13T23:55:21+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 98 | explicit | 95% | 100% |
| Code quality | 90 | strong | 90% | 100% |
| Security | 64 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 98% of first-party code added; an estimated 98% including velocity signals.
- Explicitly attributed share (lower bound): 97.9%
- Unattributed share in AI-consistent velocity bursts: 1.3%
- Estimated AI-generated share: 97.9%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 525 | 620,473 |
Current source lines last changed by AI-attributed commits: 173,017 of 178,407.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.058 | 0.0 | n/a |
| Security | 0.139 | 0.0 | n/a |
- Stylometry index: 0.13 per 1,000 lines (narrated steps 4, placeholders 0, assistant phrasing 0, emoji 38). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-12 | 449,522 | 97% |
| 2026-01 | 114,610 | 100% |
| 2026-02 | 23,948 | 100% |
| 2026-03 | 36 | 100% |
| 2026-06 | 19,138 | 92% |
| 2026-09 | 298 | 100% |
| 2026-10 | 23,614 | 100% |
| 2026-11 | 2,585 | 100% |
Evidence
- Claude Code: trailer 'Co-Authored-By: Claude' (593a9e2bfbb9)
- Claude Code: trailer 'Co-Authored-By: Claude' (a9d0add683c8)
- Claude Code: trailer 'Co-Authored-By: Claude' (acc22c2e500e)
- Claude Code: trailer 'Co-Authored-By: Claude' (cff7e4035d1f)
- Claude Code: trailer 'Co-Authored-By: Claude' (6d2918c75ae2)
- Claude Code: trailer 'Co-Authored-By: Claude' (65d99a91ca23)
- Claude Code: trailer 'Co-Authored-By: Claude' (e06d725afa7a)
- Claude Code: trailer 'Co-Authored-By: Claude' (5ca89b4f92c8)
- Claude Code: trailer 'Co-Authored-By: Claude' (05055fa86957)
- Claude Code: trailer 'Co-Authored-By: Claude' (4375751f5a26)
- Claude Code: trailer 'Co-Authored-By: Claude' (5402f239fab7)
- Claude Code: trailer 'Co-Authored-By: Claude' (2c69194f19da)
- Claude Code: trailer 'Co-Authored-By: Claude' (7e6bd4f2481b)
- Claude Code: trailer 'Co-Authored-By: Claude' (ee5eb3a42e41)
- Claude Code: trailer 'Co-Authored-By: Claude' (0496dbb504c4)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is strong: test-to-source ratio 1.78, CI runs tests; 2% of function code in complex or long functions; 12% duplicated lines. Weakest area: duplication.
| Area | Score |
|---|---|
| Complexity (lizard) | 95 |
| Duplication | 48 |
| Code smells (Opengrep) | 99 |
| Tests and CI | 100 |
| Documentation | 100 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 9,294; mean complexity 2.8, 90th percentile 6; 7 complex and 8 long functions
- Duplicated lines: 12.1% of 124,385 compared
- Tests: 317,735 test lines for 178,407 source lines (ratio 1.78); CI test commands: task test; 72% of recent source commits also change tests
- Docs missing or thin: none
Most complex functions:
- handleGen2RPC in internal/mock/server.go: complexity 148, 558 lines
- run in internal/cmd/cloud/login/login.go: complexity 45, 165 lines
- run in internal/cmd/discover/discover.go: complexity 27, 83 lines
- run in internal/cmd/cache/clearcmd/clear.go: complexity 25, 75 lines
- run in internal/cmd/firmware/update/update.go: complexity 18, 95 lines
Security
Security posture is weak: 0 possible secret(s) in the tree, 1 only in history; 16 known vulnerabilities in 6 dependencies; 14 high-severity SAST findings; 72 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 59 |
| Static analysis (Opengrep) | 97 |
| Vulnerable dependencies (OSV) | 68 |
| CI workflows (zizmor) | 0 |
| Posture (policy, updates, signing, lockfiles) | 100 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 16 in 6 packages (critical 0, high 1, medium 3, low 0)
-
Posture checks passed: security policy, dependency updates, signed commits; missing: lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/javascript.lang.security.detect-insecure-websocket: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] |
docs/man/shelly-debug-websocket.1:20 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/cmd/config/edit/edit.go:80 |
| high | opengrep/javascript.lang.security.detect-insecure-websocket: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] |
internal/cmd/debug/websocket/websocket.go:46 |
| high | opengrep/javascript.lang.security.detect-insecure-websocket: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] |
internal/cmd/debug/websocket/websocket.go:97 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/config/aliases.go:212 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/plugins/executor.go:30 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/plugins/executor.go:50 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/plugins/hooks.go:188 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/plugins/loader.go:256 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/shelly/alert.go:341 |
| high | opengrep/javascript.lang.security.detect-insecure-websocket: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] |
internal/shelly/automation/events.go:145 |
| high | opengrep/javascript.lang.security.detect-insecure-websocket: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] |
internal/shelly/monitoring/snapshot.go:174 |
| high | opengrep/javascript.lang.security.detect-insecure-websocket: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] |
internal/testutil/wsdevice.go:22 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/tui/components/scripts/editor.go:608 |
| high | osv/GHSA-r5fr-rjxr-66jc: lodash@4.17.21 (npm) is affected by GHSA-r5fr-rjxr-66jc |
docs/site/package-lock.json |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/auto-tag.yml:27 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/auto-tag.yml:32 |
| high | zizmor/excessive-permissions: overly broad permissions [confidence high] |
.github/workflows/ci.yml:11 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:28 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:31 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:37 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:50 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:53 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:59 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:76 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v0.14.7 ships shelly_0.14.7_source.tar.gz (1 downloads)
- binary-release-asset: release v0.14.7 ships shelly_darwin_amd64.tar.gz (1 downloads)
- binary-release-asset: release v0.14.7 ships shelly_darwin_arm64.tar.gz (1 downloads)
- binary-release-asset: release v0.14.7 ships shelly_linux_amd64.tar.gz (1 downloads)
- binary-release-asset: release v0.14.7 ships shelly_linux_arm64.tar.gz (1 downloads)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 178,407; test lines: 317,735
| Language | Lines |
|---|---|
| Go | 492,534 |
| Shell | 3,270 |
| PowerShell | 270 |
| JavaScript | 68 |