Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51311 analyzed
7406 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH committed secret 0xErwin1/agens Anthropic key
sk-ant…(49 chars, redacted) - HIGH committed secret 0xErwin1/agens OpenAI key
sk-liv…(23 chars, redacted) - HIGH committed secret 0xErwin1/agens AWS access key id
AKIAHY…(20 chars, redacted) - HIGH obfuscation vpavlov-me/Nerio dynamic require()/import()
const { publishedDocumentationAnchor } = await import("data:text/javascript;base64," + Buffer.from(source).toString("base64")); - HIGH obfuscation vpavlov-me/Nerio dynamic require()/import()
const runtime = require(${JSON.stringify(runtimePath)}); - HIGH dynamic exec vpavlov-me/Nerio vm exec
vm.runInNewContext(readFileSync(path, "utf8"), context, { filename: path }); - HIGH dynamic exec alphaparkinc/genpark-automated-program-repair-ast-patcher-skill eval()/exec()
exec(patched_code, ns) - HIGH dynamic exec Alpha-Park/genpark-automated-program-repair-ast-patcher-skill eval()/exec()
exec(patched_code, ns) - MEDIUM suspicious endpoint menghaoran214-lang/agent-treasury t.me
<a href="https://t.me/swithunm" target="_blank" rel="noreferrer" aria-label="Telegram @swithunm"><span className="contact-network telegram" aria-hidden="true">➤</span><span><b>Telegram</b><small>@swit - HIGH dynamic exec ThreeFish-AI/negentropy __import__()
return __import__(name, *args, **kwargs) - HIGH dynamic exec ThreeFish-AI/negentropy __import__()
__import__(module_name) - HIGH dynamic exec ThreeFish-AI/negentropy __import__()
__import__(module_name) - HIGH dynamic exec ThreeFish-AI/negentropy __import__()
__import__(f"negentropy.engine.schedulers.handlers.{module_name}") - HIGH dynamic exec ThreeFish-AI/negentropy __import__()
__import__(mod) - HIGH committed secret imMamdouhaboammar/agent-commons Anthropic key
sk-ant…(41 chars, redacted)