Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51160 analyzed
7536 re-analysis due
994 not analyzable
0 not yet analyzed
4848 source gone
not analyzable
794 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6282
- dynamic exec 11998
- obfuscation 3646
- suspicious endpoint 12540
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190134
- MEDIUM suspicious endpoint AnIayana/high-performance-mcp-server 93.184.216.34
url: "http://93.184.216.34/data", - MEDIUM suspicious endpoint AnIayana/high-performance-mcp-server 169.254.169.254 (cloud metadata)
"http://169.254.169.254:80/", - HIGH obfuscation AnIayana/high-performance-mcp-server dynamic require()/import()
const deepModule = await import("${packageJson.name}/dist/index.js"); - HIGH committed secret ysskrishna/markdown-convert-mcp Slack token
xoxb-y…(19 chars, redacted) - HIGH committed secret ysskrishna/markdown-convert-mcp Slack token
xoxb-y…(19 chars, redacted) - HIGH obfuscation pasichDev/todo-mcp dynamic require()/import()
const viewers = await import(${JSON.stringify(viewersModule)}); - HIGH obfuscation pasichDev/todo-mcp dynamic require()/import()
const { decryptFromBuffer } = await import(`${CRYPTO_MODULE}?first-run=${randomUUID()}`); - HIGH obfuscation pasichDev/todo-mcp dynamic require()/import()
const device = await import(${JSON.stringify(deviceModule)}); - HIGH dynamic exec superfly/sprites-deepseek-plugin unsafe yaml.load()
return yaml.load(handle, Loader=CordisLoader) - HIGH dynamic exec superfly/sprites-deepseek-plugin unsafe yaml.load()
return yaml.load(text, Loader=CordisLoader) - HIGH dynamic exec iTao-AI/multimodal-knowledge-engine eval()/exec()
exec(receipt._RUNTIME_EVIDENCE_SOURCE, {"__name__": "__main__"}) # noqa: S102 - HIGH dynamic exec developerDesinger/ai-brain eval()
eval(proxyInfo); - HIGH committed secret developerDesinger/ai-brain committed .env
env file shipped with populated values - HIGH dynamic exec danielyayla/veri new Function()
const fn = new Function( - HIGH dynamic exec danielyayla/veri new Function()
const fn = new Function(