Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50877 analyzed
7738 re-analysis due
994 not analyzable
1 not yet analyzed
4843 source gone
not analyzable
793 too large 201 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6279
- dynamic exec 11963
- obfuscation 3642
- suspicious endpoint 12517
- credential in log 718
- over-broad oauth scope 2539
- suspicious skill script 197
- bundled IDE extension 50
- skill file 189917
- HIGH committed secret atillacanuslu/mindsync-plugin GitLab token
glpat-…(26 chars, redacted) - HIGH committed secret atillacanuslu/mindsync-plugin Google API key
AIzaSy…(39 chars, redacted) - HIGH committed secret atillacanuslu/mindsync-plugin Stripe live key
sk_liv…(28 chars, redacted) - HIGH committed secret atillacanuslu/mindsync-plugin OpenAI key
sk-pro…(28 chars, redacted) - HIGH committed secret atillacanuslu/mindsync-plugin GitHub token
ghp_a1…(40 chars, redacted) - HIGH dynamic exec CherryHQ/stella new Function()
new Function("self", source)(scope); - HIGH committed secret CherryHQ/stella GitHub fine-grained PAT
github…(47 chars, redacted) - MEDIUM suspicious endpoint LucasLeduc/jarvis-rag-local api.telegram.org
TELEGRAM_API = "https://api.telegram.org" - HIGH dynamic exec ivanestar/eitr new Function()
const fn = new Function('return (' + source + ')')(); - HIGH dynamic exec ivanestar/eitr new Function()
expect(() => new Function('return (' + output.source + ')')()).not.toThrow(); - HIGH dynamic exec ivanestar/eitr new Function()
const fn = new Function('return ' + probe.source)(); - HIGH dynamic exec ivanestar/eitr new Function()
const { maskPii, hasPii } = new Function(PII_MASK_SOURCE + '\nreturn { maskPii, hasPii };')() as { - MEDIUM suspicious endpoint AbyssCN/oh-my-dag 93.184.216.34
assertPublicUrl('http://93.184.216.34/', { resolver: fixedResolver({}) }), - MEDIUM suspicious endpoint AbyssCN/oh-my-dag 169.254.169.254 (cloud metadata)
assertPublicUrl('http://169.254.169.254/meta', { - MEDIUM over-broad oauth scope CreativateLabs/cnode-shell https://www.googleapis.com/auth/drive
"https://www.googleapis.com/auth/drive "