Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51314 analyzed
7403 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH committed secret navdeep-h-singh/video-to-llm HuggingFace token
hf_AAA…(33 chars, redacted) - HIGH committed secret navdeep-h-singh/video-to-llm AWS access key id
AKIAAA…(20 chars, redacted) - HIGH committed secret navdeep-h-singh/video-to-llm GitHub token
ghp_AA…(40 chars, redacted) - HIGH committed secret navdeep-h-singh/video-to-llm Google OAuth client secret
GOCSPX…(27 chars, redacted) - HIGH committed secret navdeep-h-singh/video-to-llm Google API key
AIzaAA…(39 chars, redacted) - HIGH committed secret navdeep-h-singh/video-to-llm OpenAI key
sk-AAA…(35 chars, redacted) - HIGH committed secret navdeep-h-singh/video-to-llm Anthropic key
sk-ant…(53 chars, redacted) - HIGH committed secret navdeep-h-singh/video-to-llm private key
PEM private key block (redacted) - HIGH committed secret sigmalko/mcp-jira committed .env
env file shipped with populated values - HIGH dynamic exec sumit-gupta03/datacon unsafe yaml.load()
raw = yaml.load(config_path.read_text(encoding="utf-8"), Loader=ReconFlowYamlLoader) - MEDIUM suspicious endpoint demian-overflow/tgread t.me
d["url"] = f"https://t.me/{chat_username}/{m.id}" - HIGH credential in log 710git/course-drift-oracle credential in log
console.log(`private key: ${privateKey}`); - HIGH committed secret kodelyx/flow-agent Google API key
AIzaSy…(39 chars, redacted) - HIGH dynamic exec kodelyx/flow-agent __import__()
__import__(_pkg) - HIGH dynamic exec kodelyx/flow-agent __import__ sink
poll_interval_ms = int(__import__("os").environ.get("EXT_POLL_INTERVAL_MS", "1000"))