Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50067 analyzed
8096 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6178
- dynamic exec 11834
- obfuscation 3579
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187628
- HIGH dynamic exec Whatsonyourmind/modelforge __import__()
SC = getattr(__import__(cls_mod, fromlist=[cls_name]), cls_name) - HIGH dynamic exec Whatsonyourmind/modelforge __import__()
SC = getattr(__import__(spec_module, fromlist=[cls_name]), cls_name) - HIGH dynamic exec Whatsonyourmind/modelforge __import__()
qc_ws.cell(row=1, column=1, value="QC Checks").font = __import__( - HIGH dynamic exec OSOJDJD/deeplook eval()/exec()
exec(f.read(), ns) - HIGH committed secret verygoodplugins/mcp-automem GitHub token
ghu_gJ…(40 chars, redacted) - HIGH credential in log verygoodplugins/mcp-automem credential in log
console.log(JSON.stringify(buildMcpConfigJson(endpoint, apiKey), null, 2)); - HIGH dynamic exec kimlawtech/speciai-plugin new Function()
te=function(S){typeof S!="function"&&(S=new Function(""+S));for(var x=new Array(arguments. - HIGH dynamic exec kimlawtech/speciai-plugin new Function()
g,U).replace(/\[CancellationCode\]/g,x),new Function("tryCatch","errorObj","Promise","async",E)(u,s,e,r)},D=[],b=[],d=[],p=0;p<8;++p)D.push(m(p+1)),b.push(g(p+1)),d.push(f(p+1));h=function(l){this._re - HIGH dynamic exec trueoriginlabs/vibatchium __import__()
__import__(modname) - MEDIUM suspicious endpoint trueoriginlabs/vibatchium 8.8.8.8
"args": {"url": "http://8.8.8.8/x"}})) - HIGH committed secret trueoriginlabs/vibatchium OpenAI key
sk-aaa…(25 chars, redacted) - MEDIUM suspicious endpoint trueoriginlabs/vibatchium 169.254.169.254 (cloud metadata)
call("fetch", {"url": "http://169.254.169.254/latest/meta-data/"}) - HIGH dynamic exec larryfang/claude-lab-for-pms vm exec
vm.runInNewContext(fs.readFileSync(path.join(root, "assets/js/content.js"), "utf8"), sandbox, { filename: "content.js" }); - HIGH dynamic exec Ed1s0nZ/CyberStrikeAI vm exec
vm.runInNewContext( - HIGH dynamic exec Ed1s0nZ/CyberStrikeAI new Function()
const formatter = new Function(