repo-analyzer

GitHub 存储库信任评分和尽职调查。当要求分析、审核、评分、 或评估任何 GitHub 存储库 - 特别是对于加密/DeFi 项目 DD，检查存储库是否合法， 评估代码质量、验证团队可信度或比较多个存储库。还有手柄 包含 GitHub 链接的 X/Twitter URL — 从推文中自动提取和分析存储库。触发 “分析此存储库”、“这是合法的”、“检查此 GitHub”、“信任评分”、“审核此项目”、 “回购质量”、“批量扫描回购”、“分析此推文”。当用户粘贴时也会自动触发 包含 GitHub 链接的 X/Twitter URL — 不需要显式的“分析”命令。触发时 通过推文，始终在分析上方包含推文文本/上下文。 请勿在未经分析的情况下用于一般 GitHub 浏览、阅读自述文件或克隆存储库。

# Repo Analyzer

Zero-dependency GitHub trust scorer. Runs 29 analysis modules across 12 scoring categories.

## Usage

```bash
# Single repo
node scripts/analyze.js <owner/repo or github-url> [flags]

# From a tweet (auto-extracts GitHub links)
node scripts/analyze.js <x.com-or-twitter.com-url> [flags]

# Batch mode
node scripts/analyze.js --file <repos.txt> [--json]
```

### Flags
- `--json` — JSON output (for pipelines)
- `--oneline` — compact one-line score
- `--badge` — shields.io markdown badge
- `--verbose` — show progress
- `--token <pat>` — GitHub PAT (or set GITHUB_TOKEN env)
- `--file <path>` — batch mode, one repo per line (# comments ok)

### Environment
**CRITICAL:** Always run with GITHUB_TOKEN loaded. Without it, scores are severely degraded (missing stars, forks, commits).
Before running: `source ~/.bashrc` (token is in ~/.bashrc as GITHUB_TOKEN).
Or pass explicitly: `GITHUB_TOKEN="$(grep GITHUB_TOKEN ~/.bashrc | cut -d'"' -f2)" node scripts/analyze.js ...`

## Scoring (14 categories, 168pts normalized to 100)

| Category | Max | What it checks |
|----------|-----|----------------|
| Commit Health | 20 | Human vs bot, GPG sigs, code dumps, fake timestamps |
| Contributors | 15 | Bus factor, contributor diversity |
| Code Quality | 25 | Tests, CI, license, docs, lock files |
| AI Authenticity | 15 | AI slop detection in code/README |
| Social | 10 | Stars, forks, star/fork ratio, botted stars |
| Activity | 10 | Recent pushes, releases |
| Crypto Safety | 5 | Token mints, rug patterns, wallet addresses |
| Dependency Audit | 10 | Known malicious packages, typosquatting, install hooks, lock files |
| Fork Quality | 8 | Fork divergence, suspicious changes, gutted vs meaningful forks |
| README Quality | 10 | Install guide, examples, structure, API docs |
| Maintainability | 10 | File sizes, nesting, code/doc ratio |
| Project Health | 10 | Abandoned detection, velocity, issue response, PR review |
| Originality | 5 | Copy-paste, template detection, backer verification |
| Agent Safety | 15 | Install hooks, prompt injection, secrets, CI audit, permissions |

## Grade Scale
- A (85+): LEGIT
- B (70-84): SOLID
- C (55-69): MIXED
- D (40-54): SKETCHY
- F (<40): AVOID

## Key Features
- **Enhanced dependency audit**: Detects known malicious packages (event-stream, ua-parser-js, etc.), typosquatting attacks, install hooks, and estimates transitive dependency bloat
- **Fork comparison**: Analyzes fork divergence, detects cosmetic vs meaningful changes, flags suspicious modifications (removed CI, added wallets), identifies gutted forks
- **Agent safety**: Detects prompt injection, credential harvesting, install script hooks, obfuscated code
- **Secrets detection**: Finds hardcoded API keys, tokens, private keys via regex + entropy
- **Network mapping**: Categorizes all outbound domains (API, CDN, unknown)
- **CI/CD audit**: Checks GitHub Actions for pull_request_target, unpinned actions, secret leaks
- **Permissions manifest**: Summarizes what the code needs to run (like an app permissions list)
- **Author reputation**: Org memberships, suspicious repos, account age
- **Backer verification**: Cross-references investor claims vs committer org membership
- **Complexity hotspots**: Flags large files with deep nesting and high conditional density

## Batch File Format
```
# One repo per line, # for comments
Uniswap/v3-core
https://github.com/aave/aave-v3-core
OpenZeppelin/openzeppelin-contracts
```

## Output
Default: rich terminal report with bar charts, sections, verdict.
`--json`: Full structured data for programmatic use.
`--oneline`: `RepoName: 85/100 [A] — 2 flags`

## When Reporting to User
Keep it concise. Lead with score/grade and notable findings. Skip sections with nothing interesting. Example:

"Uniswap/v3-core scored 75/B — 96% GPG-signed, 11 authors, MIT license. Flagged: abandoned (466 days no push), 2,597 transitive deps (bloated), secrets in CI run commands. Agent safety: CAUTION."

---

## 中文说明

# Repo Analyzer

零依赖的 GitHub 信任评分工具。在 12 个评分类别中运行 29 个分析模块。

## 用法

```bash
# Single repo
node scripts/analyze.js <owner/repo or github-url> [flags]

# From a tweet (auto-extracts GitHub links)
node scripts/analyze.js <x.com-or-twitter.com-url> [flags]

# Batch mode
node scripts/analyze.js --file <repos.txt> [--json]
```

### 标志
- `--json` — JSON 输出（用于流水线）
- `--oneline` — 紧凑的单行评分
- `--badge` — shields.io markdown 徽章
- `--verbose` — 显示进度
- `--token <pat>` — GitHub PAT（或设置 GITHUB_TOKEN 环境变量）
- `--file <path>` — 批量模式，每行一个存储库（允许使用 # 注释）

### 环境
**关键：** 始终在加载 GITHUB_TOKEN 的情况下运行。没有它，评分会严重退化（缺少 star、fork、commit）。
运行前：`source ~/.bashrc`（token 位于 ~/.bashrc 中的 GITHUB_TOKEN）。
或显式传递：`GITHUB_TOKEN="$(grep GITHUB_TOKEN ~/.bashrc | cut -d'"' -f2)" node scripts/analyze.js ...`

## 评分（14 个类别，168 分归一化为 100 分）

| 类别 | 最高分 | 检查内容 |
|----------|-----|----------------|
| Commit Health | 20 | 人工与机器人、GPG 签名、代码倾倒、伪造时间戳 |
| Contributors | 15 | 巴士因子、贡献者多样性 |
| Code Quality | 25 | 测试、CI、许可证、文档、锁文件 |
| AI Authenticity | 15 | 检测代码/README 中的 AI 垃圾内容 |
| Social | 10 | star、fork、star/fork 比率、刷量 star |
| Activity | 10 | 近期推送、发布 |
| Crypto Safety | 5 | 代币铸造、跑路模式、钱包地址 |
| Dependency Audit | 10 | 已知恶意包、抢注、安装钩子、锁文件 |
| Fork Quality | 8 | fork 偏离、可疑更改、被掏空与有意义的 fork |
| README Quality | 10 | 安装指南、示例、结构、API 文档 |
| Maintainability | 10 | 文件大小、嵌套、代码/文档比率 |
| Project Health | 10 | 弃用检测、速度、issue 响应、PR 审查 |
| Originality | 5 | 复制粘贴、模板检测、支持者验证 |
| Agent Safety | 15 | 安装钩子、提示注入、密钥、CI 审计、权限 |

## 评级标准
- A (85+)：LEGIT（合法）
- B (70-84)：SOLID（可靠）
- C (55-69)：MIXED（参差）
- D (40-54)：SKETCHY（可疑）
- F (<40)：AVOID（避免）

## 主要功能
- **增强的依赖审计**：检测已知恶意包（event-stream、ua-parser-js 等）、抢注攻击、安装钩子，并估算传递依赖膨胀
- **Fork 对比**：分析 fork 偏离，检测表面性与实质性更改，标记可疑修改（移除 CI、添加钱包），识别被掏空的 fork
- **代理安全**：检测提示注入、凭据窃取、安装脚本钩子、混淆代码
- **密钥检测**：通过正则 + 熵查找硬编码的 API 密钥、token、私钥
- **网络映射**：对所有出站域名进行分类（API、CDN、未知）
- **CI/CD 审计**：检查 GitHub Actions 中的 pull_request_target、未固定的 action、密钥泄漏
- **权限清单**：总结代码运行所需的内容（类似应用权限列表）
- **作者信誉**：组织成员资格、可疑存储库、账户年龄
- **支持者验证**：将投资者声明与提交者的组织成员资格交叉比对
- **复杂度热点**：标记具有深层嵌套和高条件密度的大文件

## 批量文件格式
```
# One repo per line, # for comments
Uniswap/v3-core
https://github.com/aave/aave-v3-core
OpenZeppelin/openzeppelin-contracts
```

## 输出
默认：带条形图、分节和结论的丰富终端报告。
`--json`：用于程序化使用的完整结构化数据。
`--oneline`：`RepoName: 85/100 [A] — 2 flags`

## 向用户报告时
保持简洁。以评分/评级和值得注意的发现开头。跳过没有有趣内容的部分。示例：

"Uniswap/v3-core scored 75/B — 96% GPG-signed, 11 authors, MIT license. Flagged: abandoned (466 days no push), 2,597 transitive deps (bloated), secrets in CI run commands. Agent safety: CAUTION."