In reply to Rheinard Korf.

The problem is not with the tool, the problem is with how it is being marketed (at least here). Since it will be very hard to score a 10 for any non trivial plugin (any plugin/theme which generates inline CSS or JS for example), malwares be will able to safely score a 9 to be considered as "perfect", but it takes only one soft spot in the code that can be abused to make it a horrible plugin. Same goes for performance.

Security and performance have to be audited by humans that can understand the context and execution path of the code. It is nice to have helper tool, but if it was possible to trust such tools, we would have heard of such tools in other contexts as well. wordpress.com VIP for example do a manual inspection and do not trust the tool "as is".

Targeting such tools, and their results, toward users which do not have the knowledge about the possible pitifuls, is just very wrong.