Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51311 analyzed
7406 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH credential in log jmagly/hound-mcp credential in log
console.log(` Client Secret: ${clientSecret}`); - HIGH credential in log koreysmith123/recallsmith credential in log
try { logger.log("info", "turn", { botId: "b", conversationId: "c", generationId: "g", durationMs: 12, apiKey: "xai-secret-value-that-is-long" }); } - MEDIUM suspicious endpoint mukul975/Anthropic-Cybersecurity-Skills 169.254.169.254 (cloud metadata)
"ssrf_http": '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]><root>&xxe;</root>', - MEDIUM suspicious endpoint mukul975/Anthropic-Cybersecurity-Skills 169.254.169.254 (cloud metadata)
{"name": "AWS IMDSv1 metadata", "url": "http://169.254.169.254/latest/meta-data/", "indicator": "ami-id"}, - MEDIUM suspicious endpoint mukul975/Anthropic-Cybersecurity-Skills 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data/", - MEDIUM over-broad oauth scope mukul975/Anthropic-Cybersecurity-Skills https://mail.google.com/
"https://mail.google.com/inbox", - MEDIUM suspicious endpoint mukul975/Anthropic-Cybersecurity-Skills 169.254.169.254 (cloud metadata)
"aws_imdsv1": "http://169.254.169.254/latest/meta-data/", - HIGH committed secret mukul975/Anthropic-Cybersecurity-Skills AWS access key id
AKIAEX…(20 chars, redacted) - HIGH hidden prompt mukul975/Anthropic-Cybersecurity-Skills skill: hidden-unicode
ZERO_WIDTH = dict.fromkeys(map(ord, "‹U+200B›‹U+200C›‹U+200D›‹U+2060›‹U+FEFF›"), None) - HIGH obfuscation hamr0/baremobile dynamic require()/import()
const mod = await import(`../../src/setup.js?h=${encodeURIComponent(home)}`); - HIGH obfuscation hamr0/baremobile dynamic require()/import()
const mod = await import(`../../src/ios-cert.js?home=${encodeURIComponent(home)}`); - HIGH obfuscation hamr0/baremobile dynamic require()/import()
const { isDebugEnabled } = await import('${process.cwd()}/src/debug.js'); - HIGH obfuscation hamr0/baremobile dynamic require()/import()
const { connect } = await import(`${url.href}?stress=${Date.now()}`); - HIGH obfuscation hamr0/baremobile dynamic require()/import()
const { connect } = await import(`${url.href}?t=${Date.now()}`); - HIGH committed secret MatthewTracy/yagami OpenAI key
sk-Nsq…(51 chars, redacted)