Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51311 analyzed
7406 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH committed secret comisai/comis Anthropic key
sk-ant…(71 chars, redacted) - HIGH credential in log comisai/comis credential in log
log.info({ apiKey: "sk-test-secret-1234" }, "outgoing call"); - HIGH committed secret comisai/comis Slack token
xoxb-c…(23 chars, redacted) - HIGH obfuscation comisai/comis dynamic require()/import()
const { getLlama } = await import("file://" + req.resolve("node-llama-cpp")); - MEDIUM suspicious endpoint comisai/comis 169.254.169.254 (cloud metadata)
const result = await fetcher.fetch("http://169.254.169.254/latest/meta-data/"); - HIGH committed secret comisai/comis OpenAI key
sk-lea…(23 chars, redacted) - MEDIUM suspicious endpoint comisai/comis 169.254.169.254 (cloud metadata)
baseUrl: "http://169.254.169.254", - MEDIUM suspicious endpoint comisai/comis 169.254.169.254 (cloud metadata)
baseUrl: "http://169.254.169.254", - MEDIUM suspicious endpoint comisai/comis 169.254.169.254 (cloud metadata)
const result = extractLinksFromMessage("http://169.254.169.254/latest/meta-data"); - HIGH committed secret comisai/comis Anthropic key
sk-ant…(49 chars, redacted) - MEDIUM suspicious endpoint comisai/comis 1.1.1.1
`curl --noproxy '*' --max-time 3 --silent --show-error https://1.1.1.1/ 2>&1; echo "rc=$?"`, - HIGH committed secret comisai/comis OpenAI key
sk-pro…(36 chars, redacted) - MEDIUM suspicious endpoint comisai/comis 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data", - MEDIUM suspicious endpoint comisai/comis 169.254.169.254 (cloud metadata)
it.each(["http://169.254.169.254/latest/meta-data/", "https://internal.local/secret", "file:///etc/passwd"])( - MEDIUM suspicious endpoint comisai/comis 8.8.8.8
.mockResolvedValueOnce(makeRedirect("http://8.8.8.8/v2"))