Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50108 analyzed
8067 re-analysis due
988 not analyzable
0 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187702
- HIGH dynamic exec zixiao-labs/logos new Function()
const importAcp = new Function( - HIGH dynamic exec audacity4-mcp __import__()
module = __import__(f"nvidia.{pkg}", fromlist=[pkg]) - HIGH dynamic exec cubeplexai/cubepi eval()/exec()
result = eval(params.expression) - MEDIUM suspicious endpoint tangchangzhe/bt-ops-mcp-server 169.254.169.254 (cloud metadata)
{ url: "http://169.254.169.254/latest/meta-data" }, - MEDIUM suspicious endpoint tangchangzhe/bt-ops-mcp-server 1.2.3.4
panelUrl: "http://1.2.3.4:8888", - MEDIUM suspicious endpoint tangchangzhe/bt-ops-mcp-server 1.1.1.1
const value = report(await transport.call({ url: "https://1.1.1.1/" })); - HIGH obfuscation ccoussa717/alloy dynamic require()/import()
const { default: start } = await import(`../../extensions/index.ts?teams-startup=${Date.now()}`); - HIGH obfuscation ccoussa717/alloy dynamic require()/import()
const { default: start } = await import(`../../extensions/index.ts?fission-startup=${Date.now()}`); - HIGH obfuscation ccoussa717/alloy dynamic require()/import()
const { McpManager, mcpToolName } = await import(${JSON.stringify(clientUrl)}); - HIGH dynamic exec danilokhury/Synabun new Function()
HOOK_SCRIPTS: new Function(`return ${extractConst(server, 'HOOK_SCRIPTS')}`)(), - HIGH obfuscation danilokhury/Synabun dynamic require()/import()
const m = await import(`/vendor/xterm/${VENDOR_XTERM_VERSION}.min.js`); - MEDIUM suspicious endpoint danilokhury/Synabun discord.com
return text(`Created webhook "${wh.name}" (${wh.id}) in <#${wh.channel_id}>.\nToken: ${wh.token}\nURL: https://discord.com/api/webhooks/${wh.id}/${wh.token}`); - HIGH dynamic exec VibeDrift/VibeDrift new Function()
const q = new Function(`${qSource}\nreturn q;`)() as (v: unknown) => string; - HIGH committed secret VibeDrift/VibeDrift private key
PEM private key block (redacted) - HIGH dynamic exec jmo808/drawioAgent eval()
async eval(script: string, numkeys: number, ...args: string[]): Promise<any> {