Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51314 analyzed
7403 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- MEDIUM suspicious endpoint TKMD/ReftrixMCP 169.254.169.254 (cloud metadata)
const config = { ollamaUrl: "http://169.254.169.254:11434" }; - MEDIUM suspicious endpoint TKMD/ReftrixMCP 169.254.169.254 (cloud metadata)
const result = await mockFetcher.fetchCss("http://169.254.169.254/latest/meta-data/"); - MEDIUM suspicious endpoint TKMD/ReftrixMCP 169.254.169.254 (cloud metadata)
url: "http://169.254.169.254/latest/meta-data/", - MEDIUM suspicious endpoint TKMD/ReftrixMCP 169.254.169.254 (cloud metadata)
{ url: "http://169.254.169.254/latest/meta-data/", description: "AWS metadata" }, - MEDIUM suspicious endpoint TKMD/ReftrixMCP 169.254.169.254 (cloud metadata)
expect(() => assertFixtureUrlAllowlisted("http://169.254.169.254/")).toThrow( - MEDIUM suspicious endpoint TKMD/ReftrixMCP 169.254.169.254 (cloud metadata)
url: "http://169.254.169.254/latest/meta-data/", - MEDIUM suspicious endpoint TKMD/ReftrixMCP 169.254.169.254 (cloud metadata)
query_url: "http://169.254.169.254/latest/meta-data", - HIGH dynamic exec mcp-einvoicing-in __import__()
server_mod = __import__(f"{_MODULE}.server", fromlist=["mcp", "main"]) - MEDIUM suspicious endpoint leenkcool/Blue-Whale-Harness t.me
L.push(`> 自动生成于 ${date} ｜ 共 **${total}** 个仓库 ｜ 真·DSH 插件 **${dshN}** 个 | QQ Group:839509497 |Tg Group: [http://t.me/deepseekdsh](http://t.me/deepseekdsh)`) - HIGH obfuscation hesreallyhim/diy-tools-mcp dynamic require()/import()
const module = require('${filepath}'); - HIGH dynamic exec hesreallyhim/diy-tools-mcp eval()
eval("print('dangerous')") - HIGH dynamic exec hesreallyhim/diy-tools-mcp eval()
result = eval(code) # Dangerous! - MEDIUM suspicious endpoint Oshawott324/datalox-gated-runtime sentry.io (telemetry)
CANONICAL_API_URL = "https://sentry.io/api/0" - MEDIUM suspicious endpoint Oshawott324/datalox-gated-runtime us.posthog.com (telemetry)
"https://us.posthog.com.example.com/api", - MEDIUM over-broad oauth scope Oshawott324/datalox-gated-runtime delete_repo
name="delete_repo",