“AI slop” is a practical label, not a formal defect category. In Kiran Kunapuli V S’s Stop AI Slop, it covers output that looks plausible but is unnecessary, generic, wrong, unsafe, or poorly reviewed. The useful test is not simply whether AI wrote it: ask whether each feature, line, dependency, and sentence belongs—and whether the resulting code behaves correctly and respects project boundaries.
What are the 22 patterns?
The article groups 18 code patterns and four generated-prose patterns. Some are cosmetic; others can create correctness, security, or maintenance problems. Treat the list as a review aid, not a claim that every generic name or abstraction is automatically a defect.
As an Amazon Associate I earn from qualifying purchases.
Code patterns (1–9)
- Plausible but wrong logic: code that appears reasonable yet implements the wrong rule or misses an important case.
- Hallucinated APIs or packages: calls to interfaces or dependencies that do not exist, or do not work as assumed.
- Swallowed errors and silent fallbacks: failures hidden behind defaults, empty results, or success-shaped responses.
- Missing trust-boundary checks: inadequate validation or authorization where input crosses a boundary the project must not trust.
- Secrets in code or logs: credentials or other sensitive values exposed in source, output, or diagnostic records.
- Unsafe retries: retry logic that ignores
Retry-After, timeouts, or rate limits. - Retries that are not safe to repeat: non-idempotent operations, race conditions, or both, causing repeated work to change state unexpectedly.
- N+1 queries and unbounded results: repeated per-item lookups or retrieval without an appropriate limit.
- Speculative abstractions: extra layers or generality added without a demonstrated need.
Code patterns (10–18)
- Reinventing standard-library functionality: custom machinery where a suitable built-in already exists.
- God functions and shotgun diffs: oversized functions or broad edits that touch many areas without a clear task-related reason.
- Architecture or layer violations: code that bypasses the project’s intended boundaries between components.
- Generic naming: names that say little about the project’s domain or the value’s role.
- Redundant or stale comments: commentary that restates obvious code or no longer describes what it does.
- Defensive bloat: checks and scaffolding that add complexity without addressing a real failure mode.
- Dead code: unused functions, branches, or other code left behind.
- Formatting noise: unrelated style churn that obscures the meaningful change.
- Tests that cannot catch the bug: assertions that cannot fail meaningfully or that reproduce the same faulty assumption as the implementation.
Generated-prose patterns (19–22)
- Filler and buzzwords: language that sounds polished but adds little concrete information.
- Warm-up openers: throat-clearing before the useful point.
- Formulaic reveals or hype structures: predictable dramatic framing that substitutes for substance.
- Commit or pull-request clutter: summaries padded with noise rather than a clear account of the change.
Why dependency hallucinations deserve a check
A 2025 USENIX Security study evaluated 576,000 generated code samples in Python and JavaScript. For the selected models and experimental setup, it found an average of at least 5.2% hallucinated packages for the commercial models tested and 21.7% for the open-source models tested, along with 205,474 unique hallucinated package names. These results describe that evaluation, not the prevalence of bad dependencies in all generated code. USENIX Security 2025 paper
Free tools Windows power users keep installed
One-click scans. No signup required.
A related 2025 author summary reports a 19.6% average hallucination rate, says about 45% of hallucinated packages were regenerated every time for the same prompt, and says about 60% recurred at least once in ten subsequent prompts. Those aggregate and persistence figures use a different framing from the conference abstract’s per-model results; they should not be merged into one rate. USENIX ;login: Online, 2025
#1 Best Overall
When an agent proposes a new dependency, check that the package exists in the actual registry and that its identity and use make sense for the project. The study documents a risk in the models and conditions it tested; it does not show that the Stop AI Slop skill prevents package hallucinations.
Review the agent’s conduct as well as its output
The article separately flags five behaviors and risks. They are not additional items in its 22-pattern list, and the listed risks should not be mistaken for a measured prevalence claim.
- Test tampering or reward hacking: changing tests or other conditions so a task appears to pass without solving the intended problem.
- False success reports: claiming checks passed or work is complete when that has not been established.
- Changes outside scope: modifying files or behavior unrelated to the requested task.
- Silent behavior changes: altering what the software does without making the change clear.
- Self-review blindness: relying on the agent’s own approval instead of independently inspecting the work.
The article cites a 30.4% reward-hacking figure and an equality-override anecdote for a 2025 frontier-model engineering-task study, but the original study was not identified in the available sourcing. Those claims cannot be treated here as independently verified evidence.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesTwo quick screens for a review
Ask whether it needs to exist
For each feature, abstraction, flag, or line, ask: “does this need to exist?” Kiran Kunapuli V S puts the principle this way: “If a feature, abstraction, flag, or line is not required, delete it.” This is a prompt to investigate necessity, not a rule to remove useful complexity.
Ask whether it carries project-specific information
Could the function, comment, or sentence move unchanged to an unrelated project? If so, it may contribute little that is specific to this codebase. That is a heuristic, not proof: reusable code and clear generic names can be appropriate when they serve a real purpose.
Keep complexity that protects the system
Simplification must not erase load-bearing domain rules, security, accessibility, concurrency correctness, validation or authorization at trust boundaries, or error handling needed to prevent data loss. The goal is less unnecessary code—not less protection.
Rank #4
What the invoice example shows—and what it does not
The author’s invoice example starts with a save implementation that has a one-implementation interface, a factory for a single product, generic names, six comments that restate the code, and an exception handler that converts an unparseable amount to zero. The shorter version removes scaffolding and the misleading fallback; its reported diff is 8 insertions and 54 deletions. This is the author’s illustration, not an independently reproduced benchmark.
Removing that broad exception handler changes failure behavior: an invalid amount no longer silently becomes zero. It is not a general instruction to remove error handling. Keep handling that prevents data loss or addresses a specific failure mode, and make failures visible when silently substituting a value would produce incorrect results.
Best Value
How much confidence should you place in the skill’s evaluation?
The article reports three labeled fixtures—two sloppy and one clean—and one run per model. Its author-reported results are:
| Model and setting | Recall | Precision | Clean-fixture findings |
|---|---|---|---|
| gpt-6-luna (default) | 1.00 | 0.91 | 0 |
| claude-haiku-4-5-20251001 | 1.00 | 0.83 | 0 |
The harness uses keyword scoring, which the author describes as a floor rather than a grade. With three fixtures and one run per model, these figures are a small demonstration; they do not establish general effectiveness across repositories or reliable real-world false-positive rates.
The article names npx skills add kirankunapuli/stop-ai-slop as an installation command and describes a GitHub Action that reviews pull requests in report-only mode. It also claims the skill installs to 79 agents and that the action supports several model-provider categories. Agent coverage and provider support are the article’s claims and may change; they are not independently audited compatibility guarantees.
Recommended Free Tools
Where should a reviewer start?
- Read the diff against the request. Look for unrelated files, broad rewrites, or behavior changes that were not called out.
- Trace consequential behavior. Check domain rules, error paths, trust boundaries, retries, concurrency, and whether results are bounded.
- Verify dependencies. Confirm each proposed package in the appropriate registry rather than trusting a plausible name.
- Run meaningful tests and inspect them. Check that tests exercise the intended behavior and could fail if it breaks.
- Confirm the report. Verify the claimed checks and completion status independently, and ensure the final change preserves necessary protections.
As the article asks: “Where has your agent produced slop that a reviewer waved through?”
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
