Code analysis

static source read inferred

Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.

analysis coverage 85% of 59,151 analyzable servers
50066 analyzed
8097 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source

Running analyzer v33. The scanner changelog explains what each version detects and when it changed.

code findings 15 shown
  1. HIGH dynamic exec Soul-Brews-Studio/digger-node new Function() expect(() => new Function(source)).not.toThrow();
  2. MEDIUM suspicious endpoint Mangaba-ai/mangaba_ai mangaba.ngrok.app GATEWAY = "https://mangaba.ngrok.app"
  3. HIGH dynamic exec Mangaba-ai/mangaba_ai eval()/exec() exec(f"from {module} import {class_name}")
  4. HIGH dynamic exec Mangaba-ai/mangaba_ai __import__() module = __import__(module_path, fromlist=[class_name])
  5. HIGH dynamic exec Mangaba-ai/mangaba_ai __import__() module = __import__(backend)
  6. HIGH dynamic exec Mangaba-ai/mangaba_ai __import__() __import__(package)
  7. HIGH obfuscation GautamTalksDev/mcp-pin base64 decode → exec sink const der = Buffer.from(process.env.LOG_PRIVATE_KEY, 'base64');
  8. HIGH dynamic exec jagoff/memo __import__() original_collapse = __import__(
  9. HIGH dynamic exec jagoff/memo __import__() original_collapse = __import__(
  10. MEDIUM over-broad oauth scope jagoff/memo delete_repo ok = self.store.delete_repo(source["id"])
  11. HIGH committed secret DollhouseMCP/mcp-server GitHub token ghp_en…(44 chars, redacted)
  12. HIGH dynamic exec DollhouseMCP/mcp-server eval() eval(maliciousCode())
  13. HIGH dynamic exec DollhouseMCP/mcp-server eval() code: eval('1+1')
  14. HIGH dynamic exec DollhouseMCP/mcp-server eval() eval(maliciousJavaScript())
  15. MEDIUM suspicious endpoint DollhouseMCP/mcp-server 169.254.169.254 (cloud metadata) 'http://169.254.169.254/latest/meta-data/',