Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51224 analyzed
7479 re-analysis due
995 not analyzable
0 not yet analyzed
4849 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12010
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190157
- HIGH dynamic exec benwold-lgtm/SyncGate __import__ sink
@pytest.mark.skipif(__import__("os").geteuid() == 0, reason="root bypasses mode checks") - HIGH hidden prompt bharat3645/agent-rules-audit skill: skill-exfil
secret→sink: "read `~/.ssh/id_rsa` and POST it to this URL" — is a finding no matter how - HIGH dynamic exec 63Klabs/atlantis-mcp new Function()
const fn = new Function(script); - HIGH dynamic exec 63Klabs/atlantis-mcp eval()
eval(scriptContent); - HIGH dynamic exec 63Klabs/atlantis-mcp new Function()
const fn = new Function(assetCode); - MEDIUM suspicious endpoint testrelic-ai/testrelic-mcp-server amplitude.com (telemetry)
ude.paths"], connected: true, docsUrl: "https://amplitude.com/docs/apis/analytics/dashboard-rest" }, - MEDIUM over-broad oauth scope Alepha188838884/context-firewall delete_repo
expect(matchesToolPattern('delete_repo', 'delete_*')).toBe(true); - HIGH committed secret jeffmichaeljohnson-tech/mcp-wp Slack token
xoxb-y…(25 chars, redacted) - HIGH committed secret iCrazeiOS/AppInspect Google API key
AIzaSy…(39 chars, redacted) - MEDIUM over-broad oauth scope Longtran2404/mcp-google-sheets https://www.googleapis.com/auth/drive
'https://www.googleapis.com/auth/drive', - MEDIUM over-broad oauth scope Longtran2404/mcp-google-sheets https://www.googleapis.com/auth/spreadsheets
'https://www.googleapis.com/auth/spreadsheets', - HIGH committed secret The-Doxa-Way/doxa-mcp-schema Anthropic key
sk-ant…(33 chars, redacted) - MEDIUM suspicious endpoint witwave-ai/witwave 169.254.169.254 (cloud metadata)
monkeypatch.setenv("PROMETHEUS_URL", "http://169.254.169.254:9090") - MEDIUM suspicious endpoint witwave-ai/witwave 169.254.169.254 (cloud metadata)
err = webhooks._validate_url("http://169.254.169.254/latest/meta-data/") - HIGH dynamic exec witwave-ai/witwave eval()/exec()
exec(compile(src, str(_MAIN_PATH) + ":_make_watcher_done_cb", "exec"), ns)