Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51311 analyzed
7406 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH dynamic exec spinje/pflow eval()/exec()
exec(code_match.group("code"), namespace) # noqa: S102 - HIGH dynamic exec spinje/pflow eval()/exec()
exec(compiled) # noqa: S102 - HIGH dynamic exec spinje/pflow eval()/exec()
exec(code, {"__name__": module_name, "path": str(path)}) # noqa: S102 - HIGH dynamic exec spinje/pflow __import__()
module = sys.modules.get(module_name) or __import__(module_name, fromlist=[""]) - HIGH dynamic exec spinje/pflow eval()/exec()
exec(compiled, namespace) # noqa: S102 - HIGH dynamic exec Kumagaizo/latentmachine new Function()
return new Function(`${source}\nreturn transform;`)(); - HIGH committed secret alsajoo/truemend-engine GitLab token
glpat-…(27 chars, redacted) - HIGH committed secret alsajoo/truemend-engine Slack token
xoxb-y…(30 chars, redacted) - HIGH dynamic exec rossoctl/examples eval()/exec()
result_type = eval(result_type) - MEDIUM suspicious endpoint matthew-demidoff/orqlaude api.telegram.org
const BASE = "https://api.telegram.org"; - HIGH dynamic exec sumit-gupta03/reconflow unsafe yaml.load()
raw = yaml.load(config_path.read_text(encoding="utf-8"), Loader=ReconFlowYamlLoader) - MEDIUM suspicious endpoint leone-develop/api-key-case us.i.posthog.com (telemetry)
API_KEY_CASE_LP_POSTHOG_API_HOST: "https://us.i.posthog.com" - MEDIUM suspicious endpoint leone-develop/api-key-case eu.i.posthog.com (telemetry)
"API_KEY_CASE_LP_POSTHOG_API_HOST=https://eu.i.posthog.com/", - HIGH dynamic exec leone-develop/api-key-case new Function()
assert.doesNotThrow(() => new Function(secretScript)); - MEDIUM suspicious endpoint leone-develop/api-key-case eu.i.posthog.com (telemetry)
"https://eu.i.posthog.com"