In reply to Rheinard Korf.

I don't think this addresses the real issue - how to relate any code sniffing effort to plugin quality for a non-technical audience.

Presuming that plugins with serious security issues or with malware aren't on the repo, then we're left with things that are going to be hard to express in a summary rating whether that's stars, a 1-10 score or whatever. Can we reliably judge, say, the performance impact of a plugin? What if that impact is fine on low traffic sites but starts to compromise a site that has significant traffic? What if the code is high quality but it puts obnoxiously colored promos on its settings page?

I just don't see a way to sniff most code issues and relate them to things that non-technical WP users care about which is mostly 1) does this do what I need, 2) does it have any security problems, 3) does it slow down my site?