cURL scrapped its bug bounty after getting buried in AI slop. Godot is drowning in slop PRs. GitHub floated a PR kill switch. the maintainers' complaint is consistent: the code looks fine until you read it.
so i built slopsieve, a zero-dep node CLI that scores a diff or PR for the 12 signals a tired reviewer checks at 1am:
$ npx slopsieve fixtures/slop.patch
SLOP SCORE: 100/100 - ALARM
4 files · +37 -8 lines
FLAGS
[30] test weakening tests/cart.test.js:24 it.skip(...)
[25] debug leftovers src/cart.js:25 console.log("checking qty", qty)
[20] empty catch/except src/utils.js:12 } catch (e) {}
[20] trivial dependency package.json:17 adds 'is-odd'
[15] commented-out code 3 commented-out lines
[10] narration comments 6 narration comments
[10] dead exports 'isQuantityOdd' referenced nowhere in this diff
[ 5] vague util sprawl src/utils.js created
what it does: parses the unified diff, runs 12 weighted checks (it.skip, assertions removed, console.log/debugger, catch-all deps, exports nothing references, "this function..." comments), prints file and line for every flag. --fail-at makes it a CI gate, --json feeds tooling.
the bug that embarrassed me: my debug-leftovers regex dd\s*\( (laravel dump) matched isQuantityOdd( because the string "dd(" hides inside "Odd(". the tool caught nothing wrong with the fixture and everything wrong with my regex. word boundary fixed it; the test fixture keeps it fixed.
what it is not: an AI detector. it scores diff hygiene signals. a human can write a 100/100 slop diff, an LLM can write a 0/100 clean one. the README lists where the heuristics miss: two-line catch blocks, callers outside the diff, comment patterns in other languages.
github.com/princejain756/slopsieve - npx slopsieve owner/repo#123
what is the one signal you wish your PR queue flagged automatically?