Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50064 analyzed
8099 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6178
- dynamic exec 11834
- obfuscation 3579
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187628
- HIGH dynamic exec braedonsaunders/bidwright new Function()
const fn = new Function("app", code); - HIGH dynamic exec braedonsaunders/bidwright new Function()
thodFunc,returns,isAsync);var invokerFn=new Function(...args,invokerFnBody)(...closureArgs);return createNamedFunction(humanName,invokerFn)}var heap32VectorToArray=(count,firstElement)=>{var array=[]; - HIGH dynamic exec braedonsaunders/bidwright new Function()
new Function(text)(); - HIGH dynamic exec braedonsaunders/bidwright new Function()
const fn = new Function(...varNames, `"use strict"; return (${sanitized});`); - HIGH obfuscation csnyder256/gba-rom-hack-ide dynamic require()/import()
const engineModule = await import(`file://${enginePath.replace(/\\/g, '/')}`); - MEDIUM suspicious endpoint emaxe/apiGram 1.2.3.4
assert.equal(parseProxyUrl("http://1.2.3.4").port, 80); - HIGH dynamic exec Hellowda253/KIT-PUCP-MCP new Function()
for (const script of scripts) new Function(script); - MEDIUM suspicious endpoint BK927/cloud-browser-mcp 169.254.169.254 (cloud metadata)
"http://169.254.169.254/", - MEDIUM suspicious endpoint BK927/cloud-browser-mcp 169.254.169.254 (cloud metadata)
b"GET http://169.254.169.254/latest/meta-data/ HTTP/1.1\r\nHost: test\r\n\r\n" - HIGH credential in log BK927/cloud-browser-mcp credential in log
print(PasswordHasher().hash(password)) - HIGH dynamic exec AistyAI/AistyMCP eval()/exec()
exec(compile(source, "README.md", "exec"), namespace) - HIGH dynamic exec winterop-com/dhis2w-utils eval()/exec()
evaluated = eval(expr, {"__builtins__": {}, "Decimal": Decimal}) - HIGH dynamic exec winterop-com/dhis2w-utils eval()/exec()
exec(compile(source, filename, "exec"), namespace) # noqa: S102 - HIGH dynamic exec winterop-com/dhis2w-utils eval()/exec()
exec(compile(source, "<enums>", "exec"), namespace) # noqa: S102 - HIGH dynamic exec winterop-com/dhis2w-utils __import__()
module = __import__(