Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50022 analyzed
8130 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6177
- dynamic exec 11826
- obfuscation 3575
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2548
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187620
- HIGH dynamic exec devlopersujoy/localxweb concat require()
re('./log'+_0x369cd7(0xbe)),{checkPort}=require('./por'+'ts');function _0x2dee(){const _0x285718=['pgjVzhK','Bxv4','lMXVy2S','u2rOCwy' - HIGH dynamic exec devlopersujoy/localxweb concat require()
vice=require(_0x15f8f4(0x2e4)),platform=require('../ut'+'ils/p'+_0x15f8f4(0x2b9)+'rm'),config=require(_0x15f8f4(0x306)+_0x15f8f4(0x206)),logger=require('../ut'+_0x15f8f4(0x32c)+_0x15f8f4(0x1ca)),{wait - HIGH dynamic exec devlopersujoy/localxweb concat require()
ba(0x3b4)+_0x537dba(0x235)),BaseService=require('./bas'+'e'),platform=require(_0x537dba(0x194)+_0x537dba(0x2e9)+_0x537dba(0x3b5)+'rm'),config=require(_0x537dba(0x293)+_0x537dba(0x382)),logger=require( - HIGH dynamic exec devlopersujoy/localxweb concat require()
equire(_0x4cd483(0x252)+'dex'),platform=require('../ut'+'ils/p'+_0x4cd483(0x186)+'rm'),{apache,mysql,php,phpmyadmin,dbManager}=createServices(),_0x5d0f33={};_0x5d0f33[_0x4cd483(0x1d6)+'e']=apache,_0x5 - HIGH obfuscation SylphxAI/coderag dynamic require()/import()
const parserModule = (await import(`@sylphx/synth-${langLower}`)) as { - HIGH dynamic exec tenthirtyam/community-vmware-desktop-hypervisor-mcp-server __import__ sink
env = __import__("os").environ - MEDIUM suspicious endpoint Rzbyte/safehands-pharos 8.8.8.8
const allowed = ["https://8.8.8.8/", "https://1.1.1.1/dns-query", "https://[2606:4700:4700::1111]/"]; - MEDIUM suspicious endpoint Rzbyte/safehands-pharos 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data/", - MEDIUM suspicious endpoint Rzbyte/safehands-pharos 169.254.169.254 (cloud metadata)
const r = evaluateActionPolicy({ actionType: "x402_pay_and_fetch", url: "http://169.254.169.254/latest/meta-data/" }); - MEDIUM suspicious endpoint Rzbyte/safehands-pharos 169.254.169.254 (cloud metadata)
url: "http://169.254.169.254/latest/meta-data", paymentAmountUsdc: "0.01" } }, - HIGH dynamic exec southleft/story-ui eval()
const componentFrom = eval(`(${componentFromMarkupSrc})`); - HIGH dynamic exec southleft/story-ui vm exec
userConfig = vm.runInNewContext(`(${configObj})`, Object.create(null), { timeout: 1000 }); - HIGH obfuscation southleft/story-ui dynamic require()/import()
const mod = await import('${registryImport}'); - HIGH obfuscation southleft/story-ui dynamic require()/import()
const { loadUserConfig } = await import(pathToFileURL(`${DIST}/story-generator/configLoader.js`).href); - HIGH committed secret AliceLJY/agent-room-cli OpenAI key
sk-pro…(39 chars, redacted)