Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51197 analyzed
7502 re-analysis due
995 not analyzable
0 not yet analyzed
4849 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12007
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190152
- HIGH committed secret moonlin1213/cove-book-forge-mcp GitHub fine-grained PAT
github…(83 chars, redacted) - HIGH committed secret moonlin1213/cove-book-forge-mcp GitHub token
ghp_01…(40 chars, redacted) - HIGH committed secret moonlin1213/cove-book-forge-mcp OpenAI key
sk-012…(39 chars, redacted) - HIGH dynamic exec Mars535821089-ops/Codex-for-ipad new Function()
const evaluate = new Function( - HIGH committed secret skillist-io/skillist GitHub token
ghp_01…(40 chars, redacted) - MEDIUM suspicious endpoint skillist-io/skillist 93.184.216.34
expect(validateTargetUrl("https://93.184.216.34")).toBe("https://93.184.216.34/"); - MEDIUM suspicious endpoint skillist-io/skillist 169.254.169.254 (cloud metadata)
"http://169.254.169.254", // cloud metadata endpoint - MEDIUM suspicious endpoint amylyra/gpt-image-2-mcp 169.254.169.254 (cloud metadata)
image_io.fetch_url("http://169.254.169.254/latest/meta-data/") - HIGH committed secret tbrandenburg/devenv-cloud GitHub token
gho_Tl…(40 chars, redacted) - HIGH bundled IDE extension slivenred/zai-quota-monitor untrusted-exec (medium)
runs its entry point in untrusted workspaces (untrustedWorkspaces.supported) - MEDIUM suspicious endpoint amitray007/silo 169.254.169.254 (cloud metadata)
`/api/preview-image?linkId=${encodeURIComponent('http://169.254.169.254/latest/meta-data')}`, - HIGH dynamic exec amitray007/silo new Function()
const fn = new Function( - MEDIUM suspicious endpoint matthewjmcbridejr-code/Warden api.telegram.org
TELEGRAM_API_BASE = "https://api.telegram.org" - MEDIUM over-broad oauth scope matthewjmcbridejr-code/Warden https://www.googleapis.com/auth/cloud-platform
scopes=["https://www.googleapis.com/auth/cloud-platform"] - HIGH dynamic exec matthewjmcbridejr-code/Warden eval()/exec()
result = eval(expr, {"__builtins__": {}}, {})