security
Security
Every MCP risk signal in one place — CVEs, tool safety, drift, naming, licenses. Heuristic: review signals, not verdicts.
45 CRITICAL
3664 HIGH
531 MEDIUM
1207 LOW
11 NONE
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
6275 analyzed
297 re-analysis due
1444 not analyzable
9267 not yet analyzed
711 source gone
Running analyzer v17. The scanner changelog explains what each version detects and when it changed.
- hidden prompt82
- committed secret188
- dynamic exec375
- suspicious endpoint175
- token-log85
- oauth-scope112
- skill-script60
- ide-extension2
- skill file11681
- LOW skill-scriptsignetaisuspicious bundled script
ENCODED_QUERY=$(python3 -c "import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1]))" "$QUERY") - LOW skill-scriptaiwgsuspicious bundled script
eval "$(python3 -c " - LOW skill-scriptclaude-memsuspicious bundled script
if ! curl -fsSL https://bun.sh/install | bash; then - LOW skill-scriptmouse114514/Xadeus-QQ-MCPsuspicious bundled script
curl -fsSL https://get.docker.com | sh - LOW skill-scripthelius-labs/core-aisuspicious bundled script
echo " curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | bash" - LOW skill-scriptloki-modesuspicious bundled script
echo " curl -fsSL https://deno.land/install.sh | sh" - LOW skill-scriptloki-modesuspicious bundled script
log_error " Linux: curl -fsSL https://get.docker.com | sh" - LOW skill-scriptloki-modesuspicious bundled script
eval "$(_LOKI_SETTINGS_FILE="$settings_file" python3 -c " - LOW skill-scriptloki-modesuspicious bundled script
echo " curl -fsSL https://bun.sh/install | bash # any platform" >&2 - LOW skill-scriptLeo-Atienza/atlas-claudesuspicious bundled script
echo " Linux: curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash" - LOW skill-scriptLeo-Atienza/atlas-claudesuspicious bundled script
curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/nektos/act/master/install.sh | bash -s -- -b "${TOOLS_DIR}" - LOW skill-scriptLeo-Atienza/atlas-claudesuspicious bundled script
CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:PORT_NUMBER/health').read()" || exit 1 - LOW skill-scriptLeo-Atienza/atlas-claudesuspicious bundled script
CMD node -e "require('http').get('http://localhost:PORT_NUMBER/health', (r) => {process.exit(r.statusCode === 200 ? 0 : 1)})" || exit 1 - LOW skill-scriptLeo-Atienza/atlas-claudesuspicious bundled script
(re.compile(r'Invoke-WebRequest.*\|\s*(Invoke-Expression|iex)'), 'invoke-web-pipe-iex', 'Download and verify scripts before execution'), - LOW skill-scriptLeo-Atienza/atlas-claudesuspicious bundled script
echo " Linux: curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash"