Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50066 analyzed
8097 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6178
- dynamic exec 11834
- obfuscation 3579
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187628
- MEDIUM suspicious endpoint noclickapp/noclick api.ap1.datadoghq.com (telemetry)
"ap1.datadoghq.com": "https://api.ap1.datadoghq.com", - MEDIUM suspicious endpoint noclickapp/noclick api.datadoghq.eu (telemetry)
"datadoghq.eu": "https://api.datadoghq.eu", - MEDIUM suspicious endpoint noclickapp/noclick api.us5.datadoghq.com (telemetry)
"us5.datadoghq.com": "https://api.us5.datadoghq.com", - MEDIUM suspicious endpoint noclickapp/noclick api.us3.datadoghq.com (telemetry)
"us3.datadoghq.com": "https://api.us3.datadoghq.com", - MEDIUM suspicious endpoint noclickapp/noclick api.datadoghq.com (telemetry)
"datadoghq.com": "https://api.datadoghq.com", - MEDIUM over-broad oauth scope noclickapp/noclick delete_repo
operation: Literal["delete_repo"] = Field( - HIGH obfuscation strale-io/strale dynamic require()/import()
const arg=args.indexOf('--playwright');const pw=await import(arg<0?'playwright':pathToFileURL(resolve(args[arg+1])).href); - MEDIUM suspicious endpoint strale-io/strale 169.254.169.254 (cloud metadata)
await expect(validateUrl("http://169.254.169.254/latest/meta-data/")) - MEDIUM suspicious endpoint strale-io/strale 169.254.169.254 (cloud metadata)
safeFetch("http://169.254.169.254/latest/meta-data/"), - HIGH obfuscation strale-io/strale dynamic require()/import()
return await fn(await import(/* @vite-ignore */ `./${tmp.split(/[\\/]/).pop()}`)); - MEDIUM suspicious endpoint strale-io/strale 1.1.1.1
input: { url: "http://1.1.1.1" }, - MEDIUM suspicious endpoint strale-io/strale 169.254.169.254 (cloud metadata)
cap({ url: "http://169.254.169.254/latest/meta-data/" }), - MEDIUM suspicious endpoint strale-io/strale 169.254.169.254 (cloud metadata)
url: "http://169.254.169.254/latest/meta-data/", - MEDIUM suspicious endpoint strale-io/strale 169.254.169.254 (cloud metadata)
const payload = '") || fetch("http://169.254.169.254/latest/meta-data";'; - HIGH obfuscation strale-io/strale dynamic require()/import()
await import(`./${m}.js`);