Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50108 analyzed
8067 re-analysis due
988 not analyzable
0 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187702
- HIGH dynamic exec jmo808/drawioAgent eval()
async eval(script: string, numkeys: number, ...args: string[]): Promise<any> { - HIGH dynamic exec religa/multi_mcp eval()/exec()
exec(f"local_value = {raw}", {}, local) - MEDIUM suspicious endpoint hidai25/eval-view 169.254.169.254 (cloud metadata)
validate_url("http://169.254.169.254/latest/meta-data/") - MEDIUM suspicious endpoint hidai25/eval-view discord.com
notifier = DiscordNotifier("https://discord.com/api/webhooks/test") - HIGH dynamic exec hidai25/eval-view unsafe yaml.load()
return yaml.load((WORKFLOWS / filename).read_text(), Loader=yaml.BaseLoader) - MEDIUM suspicious endpoint hidai25/eval-view us.i.posthog.com (telemetry)
POSTHOG_HOST = "https://us.i.posthog.com" - HIGH dynamic exec hidai25/eval-view __import__ sink
if results and not bool(__import__("os").environ.get("CI")): - HIGH dynamic exec hidai25/eval-view __import__ sink
auto_open=not json_output and not bool(__import__("os").environ.get("CI")), - HIGH dynamic exec Casys-AI/mcp-server new Function()
new Function(script); - HIGH dynamic exec Casys-AI/mcp-server new Function()
const run = new Function("window", "document", "fetch", "console", script) as ( - HIGH committed secret Casys-AI/mcp-server committed .env
env file shipped with populated values - HIGH committed secret strvmarv/total-recall GitHub fine-grained PAT
github…(42 chars, redacted) - HIGH committed secret strvmarv/total-recall GitHub fine-grained PAT
github…(46 chars, redacted) - HIGH dynamic exec oaslananka/zaptrace __import__()
transient_reference = __import__( - HIGH dynamic exec oaslananka/zaptrace __import__ sink
mock_run.side_effect = __import__("subprocess").TimeoutExpired("kicad-cli", 30)