Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51311 analyzed
7406 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH dynamic exec syrian963/django-chainsaw-mcp __import__()
module = __import__(settings.SETTINGS_MODULE, fromlist=["__file__"]) - HIGH dynamic exec syrian963/django-chainsaw-mcp __import__ sink
"PATH": __import__("os").environ.get("PATH", ""), - HIGH committed secret mpolinowski/instar-mqtt-mcp committed .env
env file shipped with populated values - MEDIUM suspicious endpoint Swigler/claude-telegram-bridge api.telegram.org
const url = `https://api.telegram.org/file/bot${TOKEN}/${file.file_path}` - MEDIUM suspicious endpoint Swigler/claude-telegram-bridge api.telegram.org
const url = `https://api.telegram.org/file/bot${TOKEN}/${file.file_path}` - HIGH dynamic exec @keyban/agent-wallet-mcp new Function()
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); - MEDIUM suspicious endpoint aaked-app/aakd 169.254.169.254 (cloud metadata)
await expect(validateWebhookUrl("http://169.254.169.254/latest/meta-data/")).rejects.toThrow( - MEDIUM suspicious endpoint aaked-app/aakd 169.254.169.254 (cloud metadata)
vi.mocked(resolveAiConfig).mockResolvedValue({ provider: "ollama", apiKey: "http://169.254.169.254", model: "test-chat", source: "org" }) - MEDIUM over-broad oauth scope aaked-app/aakd https://mail.google.com/
expect(classifyPublicReferrer("https://mail.google.com/")).toBe("other_referral") - MEDIUM suspicious endpoint aaked-app/aakd 169.254.169.254 (cloud metadata)
[`http://169.254.169.254:80`, "http://169.254.169.254:80"], - HIGH committed secret aaked-app/aakd private key
PEM private key block (redacted) - MEDIUM suspicious endpoint aaked-app/aakd 169.254.169.254 (cloud metadata)
response.setHeader("Location", "http://169.254.169.254/latest/meta-data") - MEDIUM suspicious endpoint aaked-app/aakd 169.254.169.254 (cloud metadata)
mocks.config.mockResolvedValue({ provider: "ollama", apiKey: "http://169.254.169.254", model: "local-model", source: "org" }) - MEDIUM suspicious endpoint aaked-app/aakd discord.com
body: JSON.stringify({ channelType: "discord", webhookUrl: "https://discord.com/api/webhooks/123", label: "Discord" }), - MEDIUM suspicious endpoint aaked-app/aakd 169.254.169.254 (cloud metadata)
mocks.config.mockResolvedValue({ provider: "ollama", apiKey: "http://169.254.169.254", source: "org" })