Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50108 analyzed
8067 re-analysis due
988 not analyzable
0 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187702
- MEDIUM suspicious endpoint Elemzir/KTA-Social api.telegram.org
const r = await fetch(`https://api.telegram.org/bot${botToken}/sendMessage`, { - HIGH committed secret HafizMMoaz/corvos Google API key
AIzaSy…(39 chars, redacted) - MEDIUM over-broad oauth scope HafizMMoaz/corvos https://www.googleapis.com/auth/drive
scopes=scopes or ["https://www.googleapis.com/auth/drive"], - MEDIUM over-broad oauth scope HafizMMoaz/corvos gmail.modify
"https://www.googleapis.com/auth/gmail.modify", - MEDIUM over-broad oauth scope HafizMMoaz/corvos https://www.googleapis.com/auth/drive
"https://www.googleapis.com/auth/drive", - MEDIUM suspicious endpoint HafizMMoaz/corvos t.me
deep_link = f"https://t.me/{username}?start={code}" - HIGH committed secret HafizMMoaz/corvos Google API key
AIzaSy…(39 chars, redacted) - MEDIUM suspicious endpoint HafizMMoaz/corvos us.i.posthog.com (telemetry)
POSTHOG_HOST = os.getenv("POSTHOG_HOST", "https://us.i.posthog.com") - HIGH dynamic exec HafizMMoaz/corvos __import__ sink
__import__("os").environ.get("PERF_SLOW_REQUEST_MS", "2000") - HIGH committed secret HafizMMoaz/corvos Google API key
AIzaSy…(39 chars, redacted) - MEDIUM suspicious endpoint kaiser-data/kitsune-mcp 169.254.169.254 (cloud metadata)
assert not _is_safe_url("https://169.254.169.254/latest/meta-data/") - MEDIUM suspicious endpoint kaiser-data/kitsune-mcp 169.254.169.254 (cloud metadata)
302, headers={"location": "https://169.254.169.254/meta-data"} - HIGH dynamic exec kaiser-data/kitsune-mcp __import__ sink
"creationflags": getattr(__import__("subprocess"), "CREATE_NEW_PROCESS_GROUP", 0), - HIGH committed secret hilather/go-lab-sso private key
PEM private key block (redacted) - HIGH committed secret hilather/go-lab-sso private key
PEM private key block (redacted)