Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50877 analyzed
7738 re-analysis due
994 not analyzable
1 not yet analyzed
4843 source gone
not analyzable
793 too large 201 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6279
- dynamic exec 11963
- obfuscation 3642
- suspicious endpoint 12517
- credential in log 718
- over-broad oauth scope 2539
- suspicious skill script 197
- bundled IDE extension 50
- skill file 189917
- HIGH dynamic exec krllagent/painintheagent-mcp new Function()
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); - HIGH dynamic exec krllagent/painintheagent-mcp new Function()
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); - HIGH dynamic exec krllagent/painintheagent-mcp new Function()
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); - HIGH dynamic exec AppFreeticket/freeticket-mcp new Function()
new Function(script)(); - HIGH committed secret rulego/rulego-components-ai private key
PEM private key block (redacted) - HIGH obfuscation LanNguyenSi/codebase-oracle dynamic require()/import()
const Database = require(${JSON.stringify(require.resolve("better-sqlite3"))}); - MEDIUM over-broad oauth scope 15273/devscope-bridge gmail.modify
_SCOPES = ["https://www.googleapis.com/auth/gmail.modify"] - MEDIUM over-broad oauth scope 15273/devscope-bridge gmail.modify
_SCOPES = ["https://www.googleapis.com/auth/gmail.modify"] - HIGH dynamic exec braedonsaunders/bidwright new Function()
const fn = new Function("__sum__", ...Object.keys(values), `"use strict"; try { return __sum__ ${rest}; } catch { return 0; }`); - HIGH dynamic exec braedonsaunders/bidwright new Function()
const fn = new Function("app", code); - HIGH dynamic exec braedonsaunders/bidwright new Function()
thodFunc,returns,isAsync);var invokerFn=new Function(...args,invokerFnBody)(...closureArgs);return createNamedFunction(humanName,invokerFn)}var heap32VectorToArray=(count,firstElement)=>{var array=[]; - HIGH dynamic exec braedonsaunders/bidwright new Function()
new Function(text)(); - HIGH dynamic exec braedonsaunders/bidwright new Function()
const fn = new Function(...varNames, `"use strict"; return (${sanitized});`); - HIGH obfuscation csnyder256/gba-rom-hack-ide dynamic require()/import()
const engineModule = await import(`file://${enginePath.replace(/\\/g, '/')}`); - MEDIUM suspicious endpoint emaxe/apiGram 1.2.3.4
assert.equal(parseProxyUrl("http://1.2.3.4").port, 80);