Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50066 analyzed
8097 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6178
- dynamic exec 11834
- obfuscation 3579
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187628
- HIGH committed secret moretea-labs/forge OpenAI key
sk-SYN…(31 chars, redacted) - MEDIUM over-broad oauth scope moretea-labs/forge gmail.modify
'https://www.googleapis.com/auth/gmail.modify', - MEDIUM over-broad oauth scope moretea-labs/forge gmail.modify
'https://www.googleapis.com/auth/gmail.modify', - MEDIUM over-broad oauth scope moretea-labs/forge gmail.modify
scopes: ['gmail.modify'], - HIGH dynamic exec swapnanil/vectr __import__ sink
for k in list(__import__("os").environ): - HIGH dynamic exec swapnanil/vectr __import__()
wraps=__import__( - HIGH dynamic exec swapnanil/vectr __import__ sink
__import__("os").makedirs(db_dir, exist_ok=True) - HIGH dynamic exec swapnanil/vectr unsafe yaml.load()
doc = yaml.load("words: [on, off, yes, no, the]\n", Loader=_StrictBoolLoader) - HIGH dynamic exec swapnanil/vectr __import__ sink
env = dict(__import__("os").environ) - HIGH dynamic exec feiskyer/conferllm __import__ sink
real_replace = __import__("os").replace - HIGH committed secret feiskyer/conferllm Anthropic key
sk-ant…(34 chars, redacted) - HIGH committed secret tbrandenburg/cade GitHub token
gho_Tl…(40 chars, redacted) - HIGH credential in log sonisoft-cnanda/now-sdk-ext-mcp credential in log
logger.error('Simulated refresh failure', {password: 'fixture-sdk-password'}, new Error('Bearer fixture-sdk-bearer')); - MEDIUM suspicious endpoint ModelPiper/toolpiper 169.254.169.254 (cloud metadata)
'http://169.254.169.254', - MEDIUM suspicious endpoint TokonoMix/tokonomix-council-mcp 169.254.169.254 (cloud metadata)
() => assertSafeBaseUrl('https://169.254.169.254/api/v1', 'TOKONOMIX_BASE_URL'),