Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50100 analyzed
8073 re-analysis due
988 not analyzable
2 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187699
- HIGH dynamic exec ariffazil/arifOS __import__ sink
env={**__import__("os").environ, "NATS_CONTEXT": "kabarkan"}, - HIGH dynamic exec ariffazil/arifOS __import__()
"software_release": __import__( - HIGH dynamic exec ariffazil/arifOS __import__ sink
started_at = float(psutil.Process(__import__("os").getpid()).create_time()) - HIGH dynamic exec ariffazil/arifOS __import__()
mod = __import__(mod_name, fromlist=[fn_name]) - HIGH dynamic exec ariffazil/arifOS __import__ sink
if __import__("os").path.exists(p): - HIGH dynamic exec ariffazil/arifOS __import__()
mod = sys.modules.get(name) or __import__(name, fromlist=["*"]) - MEDIUM suspicious endpoint ariffazil/arifOS api.telegram.org
url = f"https://api.telegram.org/bot{token}/sendMessage" - HIGH dynamic exec ariffazil/arifOS __import__()
SOVEREIGN_SIGNAL_PHRASES = __import__( - HIGH dynamic exec ariffazil/arifOS __import__()
__import__(name) - HIGH dynamic exec ariffazil/arifOS __import__ sink
__import__("os").path.exists("/.dockerenv"), - MEDIUM suspicious endpoint ariffazil/arifOS api.telegram.org
TELEGRAM_API_BASE = "https://api.telegram.org" - HIGH dynamic exec ariffazil/arifOS __import__()
mod = __import__(cfg["health_module"], fromlist=[cfg["health_fn"]]) - HIGH committed secret ulises-jeremias/agent-toolkit Slack token
xoxb-y…(19 chars, redacted) - HIGH dynamic exec jonashertner/opencaselaw __import__()
__import__(mod) - HIGH dynamic exec jonashertner/opencaselaw eval()/exec()
exec(src[start:end], ns)