Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50066 analyzed
8097 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6178
- dynamic exec 11834
- obfuscation 3579
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187628
- MEDIUM suspicious endpoint rn-devtools-hub/rn-devtools-hub 172.32.0.1
"http://172.32.0.1:8081", - MEDIUM suspicious endpoint rn-devtools-hub/rn-devtools-hub 8.8.8.8
"http://8.8.8.8:8081", - HIGH obfuscation rn-devtools-hub/rn-devtools-hub dynamic require()/import()
require("${gluePath}"); - MEDIUM suspicious endpoint inite-ai/inite-mcp 169.254.169.254 (cloud metadata)
'http://169.254.169.254', - HIGH dynamic exec devlopersujoy/localxweb concat require()
re('./log'+_0x369cd7(0xbe)),{checkPort}=require('./por'+'ts');function _0x2dee(){const _0x285718=['pgjVzhK','Bxv4','lMXVy2S','u2rOCwy' - HIGH dynamic exec devlopersujoy/localxweb concat require()
vice=require(_0x15f8f4(0x2e4)),platform=require('../ut'+'ils/p'+_0x15f8f4(0x2b9)+'rm'),config=require(_0x15f8f4(0x306)+_0x15f8f4(0x206)),logger=require('../ut'+_0x15f8f4(0x32c)+_0x15f8f4(0x1ca)),{wait - HIGH dynamic exec devlopersujoy/localxweb concat require()
ba(0x3b4)+_0x537dba(0x235)),BaseService=require('./bas'+'e'),platform=require(_0x537dba(0x194)+_0x537dba(0x2e9)+_0x537dba(0x3b5)+'rm'),config=require(_0x537dba(0x293)+_0x537dba(0x382)),logger=require( - HIGH dynamic exec devlopersujoy/localxweb concat require()
equire(_0x4cd483(0x252)+'dex'),platform=require('../ut'+'ils/p'+_0x4cd483(0x186)+'rm'),{apache,mysql,php,phpmyadmin,dbManager}=createServices(),_0x5d0f33={};_0x5d0f33[_0x4cd483(0x1d6)+'e']=apache,_0x5 - HIGH obfuscation SylphxAI/coderag dynamic require()/import()
const parserModule = (await import(`@sylphx/synth-${langLower}`)) as { - HIGH dynamic exec tenthirtyam/community-vmware-desktop-hypervisor-mcp-server __import__ sink
env = __import__("os").environ - MEDIUM suspicious endpoint Rzbyte/safehands-pharos 8.8.8.8
const allowed = ["https://8.8.8.8/", "https://1.1.1.1/dns-query", "https://[2606:4700:4700::1111]/"]; - MEDIUM suspicious endpoint Rzbyte/safehands-pharos 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data/", - MEDIUM suspicious endpoint Rzbyte/safehands-pharos 169.254.169.254 (cloud metadata)
const r = evaluateActionPolicy({ actionType: "x402_pay_and_fetch", url: "http://169.254.169.254/latest/meta-data/" }); - MEDIUM suspicious endpoint Rzbyte/safehands-pharos 169.254.169.254 (cloud metadata)
url: "http://169.254.169.254/latest/meta-data", paymentAmountUsdc: "0.01" } }, - HIGH dynamic exec southleft/story-ui eval()
const componentFrom = eval(`(${componentFromMarkupSrc})`);