Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
36 of your 50 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 26.98s · analysis 1.07s · 27.7 MB · GitHub API rate-limit (preflight)

HKUDS/ViMax

https://github.com/HKUDS/ViMax.git · scanned 2026-05-20 00:19 UTC (2 weeks ago) · 10 languages

102 findings (50 legacy + 52 scanner) 11/13 scanners ran 43rd percentile · Python · small (2-20K LoC) Scanner says 98 (lower by 30)

File as issue Image v2 schema
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 weeks ago · v2 · 76 findings from 2 sources. Findings combine the legacy security pipeline AND the multi-layer engine (atlas, wiring, flows, ranked) AND verified AI agent contributions.

JSON
Combined
89.4
/100
Repobility
81
50 legacy
9-layer
98
77.8% cov · 26 gaps
Critical
0
click to filter
Agents
6
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 75.0 0.15 11.25
security_score 100.0 0.25 25.00
testing_score 30.0 0.20 6.00
documentation_score 77.0 0.15 11.55
practices_score 42.0 0.15 6.30
code_quality 75.0 0.10 7.50
Overall 1.00 67.6
security_score may be inflated — optional security scanners were skipped on this fast scan
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 29 Medium 7 Low 20 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Legacy 50 9-layer 26 Crowd 0 Layer: Quality 58 Software 14 Api 1 Frontend 1 Security 1 Cicd 1
Scan summary Repository scanned at 97.9/100 with 77.8% coverage. It contains 289 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 26 findings — concentrated in software (11), quality (11), api (1). Risk profile is low: 0 critical, 0 high, 3 medium. Recommended next step: open the software layer findings first — that's where the highest-impact wins live.

Showing 56 of 76 findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high Legacy quality quality conf 1.00 ✓ Repobility [MINED106] Phantom test coverage: test_sleep: Test function `test_sleep` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage without verifying anything.
Add an explicit assertion that captures the test's intent, or remove the test.
utils/timer.py:67 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.compress_single_novel_chunk` used but never assigned in __init__: Method `compress` of class `NovelCompressor` reads `self.compress_single_novel_chunk`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.compress_single_novel_chunk = <default>` in __init__, or add a class-level default.
agents/novel_compressor.py:118 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.create_video_generation_task` used but never assigned in __init__: Method `generate_single_video` of class `VideoGeneratorDoubaoSeedanceYunwuAPI` reads `self.create_video_generation_task`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.create_video_generation_task = <default>` in __init__, or add a class-level default.
tools/video_generator_doubao_seedance_yunwu_api.py:175 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.embeddings` used but never assigned in __init__: Method `__call__` of class `Novel2MoviePipeline` reads `self.embeddings`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.embeddings = <default>` in __init__, or add a class-level default.
pipelines/novel2movie_pipeline.py:154 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.emotion` used but never assigned in __init__: Method `__str__` of class `ShotBriefDescription` reads `self.emotion`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.emotion = <default>` in __init__, or add a class-level default.
interfaces/shot_description.py:91 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.extract_next_event` used but never assigned in __init__: Method `__call__` of class `EventExtractor` reads `self.extract_next_event`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.extract_next_event = <default>` in __init__, or add a class-level default.
agents/event_extractor.py:103 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.line` used but never assigned in __init__: Method `__str__` of class `ShotBriefDescription` reads `self.line`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.line = <default>` in __init__, or add a class-level default.
interfaces/shot_description.py:91 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.novel_compressor` used but never assigned in __init__: Method `__call__` of class `Novel2MoviePipeline` reads `self.novel_compressor`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.novel_compressor = <default>` in __init__, or add a class-level default.
pipelines/novel2movie_pipeline.py:42 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.query_video_generation_task` used but never assigned in __init__: Method `generate_single_video` of class `VideoGeneratorDoubaoSeedanceYunwuAPI` reads `self.query_video_generation_task`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.query_video_generation_task = <default>` in __init__, or add a class-level default.
tools/video_generator_doubao_seedance_yunwu_api.py:176 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.sound_effect` used but never assigned in __init__: Method `__str__` of class `ShotBriefDescription` reads `self.sound_effect`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.sound_effect = <default>` in __init__, or add a class-level default.
interfaces/shot_description.py:89 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.sound_effect` used but never assigned in __init__: Method `__str__` of class `ShotBriefDescription` reads `self.sound_effect`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.sound_effect = <default>` in __init__, or add a class-level default.
interfaces/shot_description.py:88 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.sound_effect` used but never assigned in __init__: Method `__str__` of class `ShotBriefDescription` reads `self.sound_effect`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.sound_effect = <default>` in __init__, or add a class-level default.
interfaces/shot_description.py:86 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.speaker` used but never assigned in __init__: Method `__str__` of class `ShotBriefDescription` reads `self.speaker`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.speaker = <default>` in __init__, or add a class-level default.
interfaces/shot_description.py:91 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.speaker` used but never assigned in __init__: Method `__str__` of class `ShotBriefDescription` reads `self.speaker`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.speaker = <default>` in __init__, or add a class-level default.
interfaces/shot_description.py:90 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.speaker` used but never assigned in __init__: Method `__str__` of class `ShotBriefDescription` reads `self.speaker`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.speaker = <default>` in __init__, or add a class-level default.
interfaces/shot_description.py:86 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.start_time` used but never assigned in __init__: Method `__enter__` of class `Timer` reads `self.start_time`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.start_time = <default>` in __init__, or add a class-level default.
utils/timer.py:39 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.start_time` used but never assigned in __init__: Method `__enter__` of class `Timer` reads `self.start_time`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.start_time = <default>` in __init__, or add a class-level default.
utils/timer.py:38 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.start_time` used but never assigned in __init__: Method `__exit__` of class `Timer` reads `self.start_time`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.start_time = <default>` in __init__, or add a class-level default.
utils/timer.py:49 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.working_dir` used but never assigned in __init__: Method `__call__` of class `Novel2MoviePipeline` reads `self.working_dir`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.working_dir = <default>` in __init__, or add a class-level default.
pipelines/novel2movie_pipeline.py:510 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.working_dir` used but never assigned in __init__: Method `__call__` of class `Novel2MoviePipeline` reads `self.working_dir`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.working_dir = <default>` in __init__, or add a class-level default.
pipelines/novel2movie_pipeline.py:394 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.working_dir` used but never assigned in __init__: Method `__call__` of class `Novel2MoviePipeline` reads `self.working_dir`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.working_dir = <default>` in __init__, or add a class-level default.
pipelines/novel2movie_pipeline.py:299 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.working_dir` used but never assigned in __init__: Method `__call__` of class `Novel2MoviePipeline` reads `self.working_dir`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.working_dir = <default>` in __init__, or add a class-level default.
pipelines/novel2movie_pipeline.py:233 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.working_dir` used but never assigned in __init__: Method `__call__` of class `Novel2MoviePipeline` reads `self.working_dir`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.working_dir = <default>` in __init__, or add a class-level default.
pipelines/novel2movie_pipeline.py:147 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.working_dir` used but never assigned in __init__: Method `__call__` of class `Novel2MoviePipeline` reads `self.working_dir`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.working_dir = <default>` in __init__, or add a class-level default.
pipelines/novel2movie_pipeline.py:146 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.working_dir` used but never assigned in __init__: Method `__call__` of class `Novel2MoviePipeline` reads `self.working_dir`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.working_dir = <default>` in __init__, or add a class-level default.
pipelines/novel2movie_pipeline.py:102 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.working_dir` used but never assigned in __init__: Method `__call__` of class `Novel2MoviePipeline` reads `self.working_dir`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.working_dir = <default>` in __init__, or add a class-level default.
pipelines/novel2movie_pipeline.py:35 qualitylegacy
medium Legacy quality quality conf 1.00 ✓ Repobility [MINED109] Mutable default argument in `generate_single_image` (list): `def generate_single_image(... = []/{}/set())` — Python's default value is constructed ONCE at function definition time and shared across all calls. Mutating it in one call mutates it for every future call too.
Use None as the default and create the collection inside the function: `def generate_single_image(x=None): x = x or []`
tools/image_generator_doubao_seedream_yunwu_api.py:25 qualitylegacy
medium Legacy quality quality conf 1.00 ✓ Repobility [MINED109] Mutable default argument in `generate_single_image` (list): `def generate_single_image(... = []/{}/set())` — Python's default value is constructed ONCE at function definition time and shared across all calls. Mutating it in one call mutates it for every future call too.
Use None as the default and create the collection inside the function: `def generate_single_image(x=None): x = x or []`
tools/image_generator_nanobanana_google_api.py:29 qualitylegacy
medium Legacy quality quality conf 1.00 ✓ Repobility [MINED109] Mutable default argument in `generate_single_image` (list): `def generate_single_image(... = []/{}/set())` — Python's default value is constructed ONCE at function definition time and shared across all calls. Mutating it in one call mutates it for every future call too.
Use None as the default and create the collection inside the function: `def generate_single_image(x=None): x = x or []`
tools/image_generator_nanobanana_yunwu_api.py:30 qualitylegacy
medium Legacy quality quality conf 1.00 ✓ Repobility [MINED109] Mutable default argument in `generate_single_video` (list): `def generate_single_video(... = []/{}/set())` — Python's default value is constructed ONCE at function definition time and shared across all calls. Mutating it in one call mutates it for every future call too.
Use None as the default and create the collection inside the function: `def generate_single_video(x=None): x = x or []`
tools/video_generator_veo_yunwu_api.py:40 qualitylegacy
medium 9-layer security coverage conf 1.00 No auth library detected
The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). Either auth lives in custom code, in a separate service, or is missing.
coverageauth
medium 9-layer cicd coverage conf 1.00 No CI/CD pipelines detected
No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints.
coverage
medium 9-layer quality tests conf 1.00 Very low test-to-source ratio
3 test file(s) for 48 source file(s) (ratio 0.06). Consider adding integration or unit tests for critical paths.
testscoverage
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.
pipelines/script2video_pipeline.py:37 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.
agents/script_planner.py:158 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.
agents/global_information_planner.py:97 qualitylegacy
low 9-layer quality integrity conf 1.00 Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: pipelines/script2video_pipeline.py:init_from_config, pipelines/idea2video_pipeline.py:init_from_config This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they…
integrityduplicatedry
low 9-layer quality integrity conf 1.00 Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: pipelines/script2video_pipeline.py:generate_character_portraits, pipelines/idea2video_pipeline.py:generate_character_portraits This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolid…
integrityduplicatedry
low 9-layer quality integrity conf 1.00 Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: interfaces/image_output.py:save_b64, interfaces/image_output.py:save This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.
integrityduplicatedry
low 9-layer quality integrity conf 1.00 Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: interfaces/video_output.py:save_url, interfaces/video_output.py:save This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.
integrityduplicatedry
low 9-layer quality integrity conf 1.00 Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: tools/image_generator_nanobanana_yunwu_api.py:generate_single_image, tools/image_generator_nanobanana_google_api.py:generate_single_image This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene…
integrityduplicatedry
low 9-layer quality integrity conf 1.00 Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: tools/video_generator_doubao_seedance_yunwu_api.py:create_video_generation_task, tools/video_generator_doubao_seedance_yunwu_api.py:generate_single_video This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn…
integrityduplicatedry
low 9-layer software dead-code conf 1.00 Possibly dead Python function: after_func
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
utils/retry.py:5 dead-code
low 9-layer software dead-code conf 1.00 Possibly dead Python function: compress
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
agents/novel_compressor.py:110 dead-code
low 9-layer software dead-code conf 1.00 Possibly dead Python function: generate_first_frame
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
agents/camera_image_generator.py:203 dead-code
low 9-layer software dead-code conf 1.00 Possibly dead Python function: pil_to_b64
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
utils/image.py:41 dead-code
low 9-layer software dead-code conf 1.00 Possibly dead Python function: save_b64
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
interfaces/image_output.py:26 dead-code
low 9-layer software dead-code conf 1.00 Possibly dead Python function: save_base64_image
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
utils/image.py:52 dead-code
low 9-layer software dead-code conf 1.00 Possibly dead Python function: save_bytes
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
interfaces/video_output.py:31 dead-code
low 9-layer software dead-code conf 1.00 Possibly dead Python function: save_np
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
interfaces/image_output.py:51 dead-code
low 9-layer software dead-code conf 1.00 Possibly dead Python function: save_pil
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
interfaces/image_output.py:43 dead-code
low 9-layer software dead-code conf 1.00 Possibly dead Python function: save_url
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
interfaces/image_output.py:35 dead-code
low 9-layer software dead-code conf 1.00 Possibly dead Python function: save_url
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
interfaces/video_output.py:23 dead-code
low Legacy quality quality conf 1.00 ✓ Repobility [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model.
Review and fix per the pattern semantics.
tools/render_backend.py:22 qualitylegacy
low Legacy quality quality conf 1.00 ✓ Repobility [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever.
Review and fix per the pattern semantics. See CWE-400 / for context.
utils/video.py:11 qualitylegacy
low Legacy quality quality conf 1.00 ✓ Repobility [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever.
Review and fix per the pattern semantics. See CWE-400 / for context.
utils/image.py:15 qualitylegacy
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/99b4aa28-a388-4d28-b169-2e7309b85809/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/99b4aa28-a388-4d28-b169-2e7309b85809/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.