Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51311 analyzed
7406 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH suspicious skill script navidmoazzez/apple-photos-mcp suspicious bundled script
curl -LsSf https://astral.sh/uv/install.sh | sh - HIGH obfuscation navidmoazzez/imessage-mcp dynamic require()/import()
return await import(`../src/state.ts?${Math.random()}`); - HIGH dynamic exec descambiado/BOFA eval()/exec()
exec(code, namespace) - HIGH dynamic exec descambiado/BOFA eval()/exec()
exec(code, namespace) - HIGH dynamic exec descambiado/BOFA eval()/exec()
exec(code, namespace) - MEDIUM suspicious endpoint descambiado/BOFA 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data/", # AWS - MEDIUM suspicious endpoint descambiado/BOFA t.me
print("Formatos válidos: @username, https://t.me/username, username") - HIGH obfuscation descambiado/BOFA base64 decode → exec sink
cmd = base64.b64decode("Y21kIC9jIGRpcg==").decode() - HIGH obfuscation descambiado/BOFA base64 decode → exec sink
exec(base64.b64decode({self.generate_random_string()}).decode()) - HIGH dynamic exec Br0ski777/code-sandbox-x402 new Function()
const fn = new Function("return (async () => { const __results = []; const console = { log: (...a) => __results.push(a.map(String).join(' ')), error: (...a) => __results.push('[error] ' + a.map(String - HIGH committed secret mbeato/recense Anthropic key
sk-ant…(35 chars, redacted) - MEDIUM over-broad oauth scope mbeato/recense https://mail.google.com/
expect(SOURCE_CODE_ONLY).not.toContain('https://mail.google.com/'); - HIGH obfuscation mbeato/recense dynamic require()/import()
const D=require(__dirname+'/../node_modules/better-sqlite3'); - HIGH obfuscation mbeato/recense dynamic require()/import()
const { initSchema } = require(DIST + '/db/schema'); - HIGH obfuscation mbeato/recense dynamic require()/import()
const { resolveProviderOverlay } = require(DIST + '/consolidation/run-sleep-pass');