Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50020 analyzed
8131 re-analysis due
988 not analyzable
1 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6177
- dynamic exec 11826
- obfuscation 3575
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2548
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187620
- HIGH committed secret majiayu000/remem GitHub token
ghp_01…(40 chars, redacted) - MEDIUM suspicious endpoint scalekit-inc/scalekit-mcp-server us.i.posthog.com (telemetry)
? new PostHog(config.posthogApiKey, { host: 'https://us.i.posthog.com' }) - HIGH committed secret openai/tunnel-client private key
PEM private key block (redacted) - HIGH dynamic exec leandre755/HIVE-MIND eval()
async eval( - HIGH dynamic exec leandre755/HIVE-MIND eval()
6. INTERDICTION ABSOLUE: Ne JAMAIS utiliser require(), import(), eval() ou fetch(). Utilise UNIQUEMENT les outils fournis ci-dessus. - MEDIUM suspicious endpoint leandre755/HIVE-MIND 13.53.192.140
const N8N_WEBHOOK_URL = 'https://13.53.192.140:5678/webhook/hive-send-email'; - MEDIUM suspicious endpoint leandre755/HIVE-MIND api.telegram.org
const res = await fetch(`https://api.telegram.org/bot${cleanToken}/getMe`, { signal }); - HIGH dynamic exec Mehmoodqureshi/chrome-mcp eval()
async eval() { - HIGH dynamic exec Mehmoodqureshi/chrome-mcp eval()
eval(expression: string, opts?: { tabId?: TabId; awaitPromise?: boolean } & FrameOpts): Promise<EvalResult>; - HIGH dynamic exec Mehmoodqureshi/chrome-mcp eval()
async eval(expression: string): Promise<EvalResult> { - HIGH dynamic exec Mehmoodqureshi/chrome-mcp eval()
async eval(expression: string, opts?: { tabId?: TabId; awaitPromise?: boolean } & FrameOpts): Promise<EvalResult> { - HIGH dynamic exec Mehmoodqureshi/chrome-mcp eval()
async eval(expression: string, opts?: { tabId?: TabId; awaitPromise?: boolean }): Promise<EvalResult> { - HIGH dynamic exec Mehmoodqureshi/chrome-mcp indirect eval
const fn = (0, eval)(`(${fnSrc})`) as (i: boolean, m: number, l: unknown) => unknown; - HIGH dynamic exec Mehmoodqureshi/chrome-mcp indirect eval
const v = (0, eval)(e as string); - MEDIUM suspicious endpoint OpenOSINT/OpenOSINT 169.254.169.254 (cloud metadata)
await _validate_outbound_base_url("http://169.254.169.254/latest/meta-data/")