Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51224 analyzed
7479 re-analysis due
995 not analyzable
0 not yet analyzed
4849 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12010
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190157
- MEDIUM suspicious endpoint criptogus/HermesOffice 8.8.8.8
await expect(isSafeRemoteUrl('https://8.8.8.8/x.png')).resolves.toBe(true) - MEDIUM suspicious endpoint criptogus/HermesOffice 169.254.169.254 (cloud metadata)
'http://169.254.169.254/latest/meta-data/', - HIGH committed secret criptogus/HermesOffice GitHub token
ghp_01…(40 chars, redacted) - MEDIUM suspicious endpoint criptogus/HermesOffice www.google-analytics.com (telemetry)
'https://www.google-analytics.com/mp/collect?measurement_id=G-TEST123&api_secret=secret', - MEDIUM suspicious endpoint criptogus/HermesOffice www.google-analytics.com (telemetry)
'https://www.google-analytics.com/mp/collect' + - HIGH dynamic exec CChuYong/rookery eval()
async eval(expression) { - MEDIUM over-broad oauth scope HabaAndrei/custom-chrome-dev-mcp https://mail.google.com/
"https://mail.google.com/mail/u/0", - HIGH dynamic exec HabaAndrei/custom-chrome-dev-mcp indirect eval
const v = (0, eval)(expr); - MEDIUM suspicious endpoint jgalea/mailbox-mcp 169.254.169.254 (cloud metadata)
expect(() => validateNoSSRF("http://169.254.169.254/metadata")).toThrow("blocked"); - MEDIUM over-broad oauth scope jgalea/mailbox-mcp gmail.modify
"https://www.googleapis.com/auth/gmail.modify", // Read, send, trash, labels, filters - HIGH dynamic exec totekuh/winbox eval()/exec()
exec("\n".join(lines[start:end]), ns) - MEDIUM over-broad oauth scope zorahrel/jarvis-claudecode https://www.googleapis.com/auth/spreadsheets
sheets: "https://www.googleapis.com/auth/spreadsheets", - MEDIUM over-broad oauth scope zorahrel/jarvis-claudecode https://www.googleapis.com/auth/documents
docs: "https://www.googleapis.com/auth/documents", - MEDIUM over-broad oauth scope zorahrel/jarvis-claudecode https://www.googleapis.com/auth/drive
drive: "https://www.googleapis.com/auth/drive", - MEDIUM over-broad oauth scope zorahrel/jarvis-claudecode gmail.modify
gmail: "https://www.googleapis.com/auth/gmail.modify",