trogdoro/xiki
A shell console with GUI features
- Repository: https://github.com/trogdoro/xiki
- Commit:
be9b5eb87fb6eac11c70adbbb602bb71895834a8 - Generated: 2026-11-13T23:28:36+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | none-detected | 65% | 100% |
| Code quality | 60 | weak | 90% | 100% |
| Security | 70 | adequate | 85% | 100% |
AI provenance
No AI attribution or AI-consistent velocity signals detected.
-
Explicitly attributed share (lower bound): 0.0%
-
Unattributed share in AI-consistent velocity bursts: 0.0%
-
Estimated AI-generated share: 0.0%
-
Stylometry index: 0.09 per 1,000 lines (narrated steps 5, placeholders 0, assistant phrasing 0, emoji 0). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2014-12 | 2,751 | 0% |
| 2015-01 | 3,604 | 0% |
| 2015-02 | 2,287 | 0% |
| 2015-03 | 1,910 | 0% |
| 2015-04 | 1,516 | 0% |
| 2015-05 | 1,454 | 0% |
| 2016-08 | 16,072 | 0% |
| 2016-09 | 989 | 0% |
| 2016-10 | 286 | 0% |
| 2016-11 | 77 | 0% |
| 2019-05 | 4 | 0% |
| 2020-01 | 51 | 0% |
Evidence
- step-by-step narration comment: # Then, remove backslashes before spaces... (lib/xiki/cor)
- step-by-step narration comment: # First, make sure the current line is quoted (otherwise, .siblings will be pulling from somewhere else) (lib/xiki/cor)
- step-by-step narration comment: # Step 1. Join to "a/=b/c"... (lib/xiki/cor)
- step-by-step narration comment: # Step 2. Split to "a/", "b/c/"... (lib/xiki/cor)
- step-by-step narration comment: # First, maybe find code that does "##" (roots/filter)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.08, no CI test run detected; 21% of function code in complex or long functions; 2% duplicated lines. Weakest area: testing.
| Area | Score |
|---|---|
| Complexity (lizard) | 54 |
| Duplication | 90 |
| Code smells (Opengrep) | 99 |
| Tests and CI | 25 |
| Documentation | 65 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 2,477; mean complexity 3.3, 90th percentile 7; 71 complex and 17 long functions
- Duplicated lines: 1.8% of 35,645 compared
- Tests: 4,518 test lines for 57,312 source lines (ratio 0.08); CI test commands: none detected; 4% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- self.run in lib/xiki/core/xsh.rb: complexity 72, 188 lines
- self.expand in lib/xiki/core/topic_expander.rb: complexity 58, 145 lines
- self.invoke in lib/xiki/core/invoker.rb: complexity 52, 116 lines
- self.drill in lib/xiki/core/notes.rb: complexity 52, 183 lines
- self.as_task in lib/xiki/core/notes.rb: complexity 43, 82 lines
Security
Security posture is adequate: 17 high-severity SAST findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 90 |
| Static analysis (Opengrep) | 81 |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/dockerfile.security.missing-user: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
Dockerfile:20 |
| high | opengrep/ruby.rails.security.brakeman.check-regex-dos: Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the [confidence medium] |
lib/xiki/core/diff_log.rb:70 |
| high | opengrep/ruby.rails.security.brakeman.check-regex-dos: Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the [confidence medium] |
lib/xiki/core/diff_log.rb:73 |
| high | opengrep/ruby.rails.security.brakeman.check-regex-dos: Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the [confidence medium] |
lib/xiki/core/search.rb:570 |
| high | opengrep/ruby.rails.security.brakeman.check-regex-dos: Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the [confidence medium] |
lib/xiki/core/search.rb:572 |
| high | opengrep/ruby.rails.security.brakeman.check-regex-dos: Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the [confidence medium] |
lib/xiki/core/shell.rb:532 |
| high | opengrep/ruby.rails.security.brakeman.check-regex-dos: Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the [confidence medium] |
lib/xiki/core/specs.rb:106 |
| high | opengrep/ruby.rails.security.brakeman.check-regex-dos: Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the [confidence medium] |
lib/xiki/core/topic_expander.rb:530 |
| high | opengrep/ruby.lang.security.bad-deserialization-yaml: Unsafe deserialization from YAML. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with YAML can potentially be dangerous. Use JSON in a secure fashion instead. However, loading Y [confidence low] |
lib/xiki/tools/memcache.rb:102 |
| high | opengrep/ruby.lang.security.bad-deserialization-yaml: Unsafe deserialization from YAML. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with YAML can potentially be dangerous. Use JSON in a secure fashion instead. However, loading Y [confidence low] |
lib/xiki/tools/riak_tree.rb:41 |
| high | opengrep/ruby.lang.security.bad-deserialization-yaml: Unsafe deserialization from YAML. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with YAML can potentially be dangerous. Use JSON in a secure fashion instead. However, loading Y [confidence low] |
lib/xiki/tools/riak_tree.rb:43 |
| high | opengrep/ruby.lang.security.bad-deserialization-yaml: Unsafe deserialization from YAML. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with YAML can potentially be dangerous. Use JSON in a secure fashion instead. However, loading Y [confidence low] |
lib/xiki/tools/riak_tree.rb:110 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
misc/www/xiki_web_server.rb:28 |
| high | opengrep/ruby.lang.security.bad-deserialization-yaml: Unsafe deserialization from YAML. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with YAML can potentially be dangerous. Use JSON in a secure fashion instead. However, loading Y [confidence low] |
roots/couch.rb:156 |
| high | opengrep/ruby.lang.security.bad-deserialization-yaml: Unsafe deserialization from YAML. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with YAML can potentially be dangerous. Use JSON in a secure fashion instead. However, loading Y [confidence low] |
roots/face/face_index.rb:5 |
| high | opengrep/ruby.lang.security.bad-deserialization-yaml: Unsafe deserialization from YAML. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with YAML can potentially be dangerous. Use JSON in a secure fashion instead. However, loading Y [confidence low] |
roots/models.rb:59 |
| high | opengrep/ruby.lang.security.bad-deserialization-yaml: Unsafe deserialization from YAML. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with YAML can potentially be dangerous. Use JSON in a secure fashion instead. However, loading Y [confidence low] |
roots/mysql/mysql_index.rb:287 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/xiki/core/code.rb:118 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/xiki/core/code.rb:726 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/xiki/core/code.rb:728 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/xiki/core/file_tree.rb:602 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/xiki/core/file_tree.rb:642 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/xiki/core/file_tree.rb:1660 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/xiki/core/files.rb:219 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/xiki/core/files.rb:286 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 57,312; test lines: 4,518
| Language | Lines |
|---|---|
| Ruby | 61,122 |
| Python | 335 |
| JavaScript | 314 |
| Shell | 59 |