Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51197 analyzed
7502 re-analysis due
995 not analyzable
0 not yet analyzed
4849 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12007
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190152
- MEDIUM suspicious endpoint Konuktor/rigorrun 169.254.169.254 (cloud metadata)
expect(() => assertSafeMcpUrl('http://169.254.169.254/latest/meta-data/')).toThrow( - MEDIUM suspicious endpoint Konuktor/rigorrun 169.254.169.254 (cloud metadata)
expect(() => assertSafeAgentUrl('http://169.254.169.254/latest/meta-data/')).toThrow(); - MEDIUM suspicious endpoint Neeraj829784/zap-mcp-server 169.254.169.254 (cloud metadata)
result = await scanners.zap_active_scan("http://169.254.169.254/") - MEDIUM suspicious endpoint Neeraj829784/zap-mcp-server 169.254.169.254 (cloud metadata)
policy.authorize_target("http://169.254.169.254/latest/meta-data/") - HIGH committed secret br9704/mcpaudit GitHub token
ghp_LE…(40 chars, redacted) - MEDIUM suspicious endpoint br9704/mcpaudit 169.254.169.254 (cloud metadata)
payload: { $ref: "http://169.254.169.254/latest/meta-data/iam/security-credentials/" }, - HIGH committed secret br9704/mcpaudit OpenAI key
sk-liv…(34 chars, redacted) - MEDIUM suspicious endpoint hect0x7/jmcomic-ai t.me
self.assertTrue(doctor.is_telegram_link("https://t.me/hcomic18")) - HIGH committed secret yubinbin32-ops/Mdflow-Canvas GitHub token
ghp_98…(42 chars, redacted) - HIGH dynamic exec yubinbin32-ops/Mdflow-Canvas new Function()
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); - HIGH suspicious skill script Coding-Meet/Library-Insight suspicious bundled script
curl -fsSL https://raw.githubusercontent.com/Coding-Meet/Library-Insight/main/install.sh | bash - MEDIUM suspicious endpoint agentwares/libs discord.com
discord: "https://discord.com/api/webhooks/1/abc", - MEDIUM suspicious endpoint agentwares/libs discord.com
"https://discord.com/api/webhooks/1/abc", - HIGH dynamic exec laoyudashu/voko vm exec
vm.runInNewContext(fs.readFileSync(entry,'utf8'),{ - HIGH dynamic exec laoyudashu/voko new Function()
scripts.forEach((source) => assert.doesNotThrow(() => new Function(source)));