Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51314 analyzed
7403 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH dynamic exec abhishekpandaOfficial/XOne eval()/exec()
exec(compile(func_src, "<verify_global_reachability>", "exec"), ns) - HIGH dynamic exec abhishekpandaOfficial/XOne eval()/exec()
exec(compile(module, "<extracted studio_db.py>", "exec"), ns) - HIGH dynamic exec abhishekpandaOfficial/XOne __import__()
__import__(name) - HIGH dynamic exec abhishekpandaOfficial/XOne __import__()
__import__(import_name) - HIGH obfuscation abhishekpandaOfficial/XOne base64 decode → exec sink
(WORK / {json.dumps(PAYLOAD_NOTEBOOK)}).write_bytes(gzip.decompress(base64.b64decode(PAYLOAD))) - HIGH credential in log ohwisey/vitality-oss credential in log
console.log(` Password: ${TEST_PASSWORD}`) - HIGH credential in log ohwisey/vitality-oss credential in log
console.log(` Password: ${TEST_PASSWORD}`) - MEDIUM over-broad oauth scope ohwisey/vitality-oss https://mail.google.com/
{ id: 'gmail', label: 'Gmail', icon: '✉️', url: 'https://mail.google.com/', what: 'my unread emails (inbox + Primary)' }, - HIGH obfuscation VoltAgent/voltagent dynamic require()/import()
require(`prismjs/components/prism-${lang}`); // not a language specific diff - HIGH dynamic exec VoltAgent/voltagent new Function()
return new Function(`return ${objectLiteral};`)(); - HIGH committed secret VoltAgent/voltagent Slack token
xoxb-y…(19 chars, redacted) - MEDIUM suspicious endpoint VoltAgent/voltagent us.i.posthog.com (telemetry)
host: "https://us.i.posthog.com", - HIGH dynamic exec VoltAgent/voltagent eval()
return { result: eval(expression) }; - MEDIUM suspicious endpoint VoltAgent/voltagent us.i.posthog.com (telemetry)
host: "https://us.i.posthog.com", - HIGH committed secret VoltAgent/voltagent Slack token
xoxb-y…(19 chars, redacted)