Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51193 analyzed
7507 re-analysis due
995 not analyzable
0 not yet analyzed
4848 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12007
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190152
- MEDIUM suspicious endpoint las-team/lastest 8.8.8.8
expect(validateUrl("http://8.8.8.8")).toBeNull(); - HIGH dynamic exec las-team/lastest new Function()
const func = new Function("window", `return ${fn}`); - HIGH obfuscation las-team/lastest dynamic require()/import()
const p = require(${JSON.stringify( - MEDIUM suspicious endpoint las-team/lastest analytics.google.com (telemetry)
req({ url: "https://analytics.google.com/track" }), - HIGH dynamic exec las-team/lastest new Function()
expect(() => new Function(body)).not.toThrow(); - HIGH dynamic exec las-team/lastest setTimeout(string)
onClick={() => setInterval("monthly")} - MEDIUM suspicious endpoint las-team/lastest 169.254.169.254 (cloud metadata)
url: "http://169.254.169.254/latest/meta-data", - HIGH dynamic exec las-team/lastest new Function()
const func = new Function("window", `return ${fn}`); - HIGH committed secret las-team/lastest GitHub token
gho_16…(40 chars, redacted) - HIGH dynamic exec las-team/lastest new Function()
new Function(body); - HIGH dynamic exec las-team/lastest new Function()
new Function(body); - HIGH obfuscation thearchitect0x-glitch/ratchet dynamic require()/import()
const mod = await import(`../../src/lib/ssrf.js?strict=${Date.now()}`); - MEDIUM suspicious endpoint thearchitect0x-glitch/ratchet 169.254.169.254 (cloud metadata)
'https://localhost/', 'https://LOCALHOST./', 'https://169.254.169.254/latest/meta-data/', - HIGH dynamic exec thearchitect0x-glitch/ratchet new Function()
return new Function(`${m[0]}; return when;`)() as (iso: string | null) => string; - MEDIUM suspicious endpoint thearchitect0x-glitch/ratchet 169.254.169.254 (cloud metadata)
['http://169.254.169.254/latest/meta-data/', 'cloud instance metadata'],