Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51311 analyzed
7406 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH obfuscation AlKindy-OSS/nassaj dynamic require()/import()
const loaded = await import(`${pathToFileURL(path.join(services, 'preview-runtime-attestation.js')).href}?fixture=${Date.now()}`); - HIGH dynamic exec AlKindy-OSS/nassaj new Function()
const factory = new Function( - HIGH obfuscation AlKindy-OSS/nassaj dynamic require()/import()
const { createConnectorOAuthPendingDb } = await import(${JSON.stringify(repositoryUrl)}); - MEDIUM over-broad oauth scope AlKindy-OSS/nassaj gmail.modify
gmail: 'https://www.googleapis.com/auth/gmail.modify', - MEDIUM over-broad oauth scope AlKindy-OSS/nassaj https://www.googleapis.com/auth/drive
'google-drive': 'https://www.googleapis.com/auth/drive', - HIGH dynamic exec AlKindy-OSS/nassaj new Function()
const factory = new Function( - HIGH dynamic exec AlKindy-OSS/nassaj new Function()
const factory = new Function( - HIGH dynamic exec AlKindy-OSS/nassaj new Function()
return new Function(`return (${literal});`)(); - HIGH dynamic exec AlKindy-OSS/nassaj new Function()
try { ({ detect, detectSessionId } = new Function(detectSrc)()); } - HIGH obfuscation AlKindy-OSS/nassaj dynamic require()/import()
const imported = await import(`${pathToFileURL(path.join(artifact, 'scripts/lib/update-runtime-capability.mjs')).href}?fixture=${Date.now()}`); - HIGH obfuscation AlKindy-OSS/nassaj dynamic require()/import()
const bundled = await import(`${pathToFileURL(path.join(extracted, 'scripts/install-release-runtime.mjs')).href}?test=${Date.now()}`); - HIGH obfuscation AlKindy-OSS/nassaj dynamic require()/import()
const bundled = await import(`${pathToFileURL(path.join(extracted, 'scripts/install-release-host-support.mjs')).href}?bundle=${Date.now()}`); - HIGH obfuscation AlKindy-OSS/nassaj dynamic require()/import()
const contract = injected.contract || await import(`${pathToFileURL(path.join(sourceRoot, 'scripts', 'client-build-atomic.mjs')).href}?source=${oid}`); - HIGH committed secret mphinance/etf-holdings-tracker Google API key
AIzaSy…(39 chars, redacted) - MEDIUM suspicious endpoint mphinance/etf-holdings-tracker discord.com
if (!webhookUrl.startsWith('https://discord.com/api/webhooks/')) return;