Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51311 analyzed
7406 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- MEDIUM suspicious endpoint lqyver/ScopeGraph 9.9.9.9
"doh:https://9.9.9.9/dns-query", - MEDIUM suspicious endpoint lqyver/ScopeGraph 1.1.1.1
"doh:https://1.1.1.1/dns-query", - HIGH committed secret Miosa-osa/SOMA AWS access key id
AKIA01…(20 chars, redacted) - HIGH committed secret Miosa-osa/SOMA AWS access key id
AKIA01…(20 chars, redacted) - HIGH dynamic exec @delorenj/mcp-server-trello new Function()
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); - HIGH obfuscation DanielJD1216/Source-Wire dynamic require()/import()
const { canonicalRequestDigest } = await import(${JSON.stringify(modulePath)}); - HIGH committed secret CRM-Solid/crmsolid-mcp Stripe live key
sk_liv…(44 chars, redacted) - MEDIUM suspicious endpoint indextkn/indextkn-mcp 169.254.169.254 (cloud metadata)
expect(() => loadConfig({ INDEXTKN_API_BASE: "http://169.254.169.254" })).toThrow(/https/); - HIGH dynamic exec DB-25/arc-control-mcp new Function()
assert.doesNotThrow(() => new Function('A', body)); - HIGH dynamic exec DB-25/arc-control-mcp vm exec
const runInPage = (body) => JSON.parse(JSON.stringify(vm.runInNewContext(pageScript(body)))); - HIGH dynamic exec DB-25/arc-control-mcp vm exec
const reEncodeInScript = (literal) => vm.runInNewContext(`JSON.stringify(${literal})`); - HIGH obfuscation DB-25/arc-control-mcp dynamic require()/import()
const module = await import(`../src/tools/${name}.js`); - HIGH dynamic exec DB-25/arc-control-mcp new Function()
new Function('A', body); - MEDIUM suspicious endpoint Matte-AI-LLC/stma discord.com
placeholder="https://hooks.slack.com/services/… or https://discord.com/api/webhooks/…" - MEDIUM suspicious endpoint Hei33enberg/WhiteIntel-OS 169.254.169.254 (cloud metadata)
assert.equal(resolveBase("https://169.254.169.254", silent), DEFAULT_BASE);