Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51192 analyzed
7507 re-analysis due
995 not analyzable
1 not yet analyzed
4848 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12007
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190152
- HIGH dynamic exec Orkas-AI/Orkas vm exec
return vm.runInNewContext(fns, sandbox); - HIGH dynamic exec Orkas-AI/Orkas vm exec
return vm.runInNewContext(`${fns}\n_moveUserBeforeOrphanLivePlaceholder;`, {}); - HIGH dynamic exec Orkas-AI/Orkas vm exec
return vm.runInNewContext(`(${fnSource})`, {}); - HIGH dynamic exec Orkas-AI/Orkas vm exec
const forget = vm.runInNewContext(`(${extractFunction('_forgetCidRecipient')})`, globals); - HIGH dynamic exec Orkas-AI/Orkas vm exec
return vm.runInNewContext(`${fnSource}\n_isFailedAssistantContent;`, {}); - HIGH dynamic exec Orkas-AI/Orkas vm exec
const api = vm.runInNewContext(`${funcs}\n({ finalize: _streamingFinalizeCommentary, append: _streamingAppendFinalDelta });`, context); - HIGH dynamic exec Orkas-AI/Orkas vm exec
vm.runInNewContext(source, { - HIGH dynamic exec Orkas-AI/Orkas vm exec
return vm.runInNewContext(` - HIGH dynamic exec Orkas-AI/Orkas vm exec
vm.runInNewContext(fs.readFileSync(path.resolve(__dirname, '../../src/renderer/modules/cli_async_input.js'), 'utf8'), context); - HIGH dynamic exec Orkas-AI/Orkas vm exec
return vm.runInNewContext(` - HIGH dynamic exec Orkas-AI/Orkas vm exec
return vm.runInNewContext(` - HIGH dynamic exec Orkas-AI/Orkas vm exec
vm.runInNewContext(source, sandbox, { filename: 'chat-md-drawer.js' }); - HIGH dynamic exec Orkas-AI/Orkas vm exec
const successRate = vm.runInNewContext(`(${match?.[0]})`) as (runtime: Record<string, number>) => number; - HIGH dynamic exec Orkas-AI/Orkas vm exec
return vm.runInNewContext(` - HIGH dynamic exec Orkas-AI/Orkas vm exec
expect(() => vm.runInNewContext(fs.readFileSync(entry, 'utf8'), {