Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51311 analyzed
7406 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH committed secret lensnowovo/N.E.I.-The-World-of-Financial-Evolution private key
PEM private key block (redacted) - HIGH committed secret lensnowovo/N.E.I.-The-World-of-Financial-Evolution private key
PEM private key block (redacted) - HIGH committed secret SHREESH2004/TweetPilot-MCP Google API key
AIzaSy…(39 chars, redacted) - HIGH dynamic exec Whatsonyourmind/modelforge __import__()
SC = getattr(__import__(mod, fromlist=[name]), name) - HIGH dynamic exec Whatsonyourmind/modelforge __import__()
SC = getattr(__import__(cls_mod, fromlist=[cls_name]), cls_name) - HIGH dynamic exec Whatsonyourmind/modelforge __import__()
SC = getattr(__import__(spec_module, fromlist=[cls_name]), cls_name) - HIGH dynamic exec Whatsonyourmind/modelforge __import__()
qc_ws.cell(row=1, column=1, value="QC Checks").font = __import__( - HIGH dynamic exec OSOJDJD/deeplook eval()/exec()
exec(f.read(), ns) - HIGH committed secret verygoodplugins/mcp-automem GitHub token
ghu_gJ…(40 chars, redacted) - HIGH credential in log verygoodplugins/mcp-automem credential in log
console.log(JSON.stringify(buildMcpConfigJson(endpoint, apiKey), null, 2)); - HIGH dynamic exec kimlawtech/speciai-plugin new Function()
te=function(S){typeof S!="function"&&(S=new Function(""+S));for(var x=new Array(arguments. - HIGH dynamic exec kimlawtech/speciai-plugin new Function()
g,U).replace(/\[CancellationCode\]/g,x),new Function("tryCatch","errorObj","Promise","async",E)(u,s,e,r)},D=[],b=[],d=[],p=0;p<8;++p)D.push(m(p+1)),b.push(g(p+1)),d.push(f(p+1));h=function(l){this._re - HIGH dynamic exec trueoriginlabs/vibatchium __import__()
__import__(modname) - MEDIUM suspicious endpoint trueoriginlabs/vibatchium 8.8.8.8
"args": {"url": "http://8.8.8.8/x"}})) - HIGH committed secret trueoriginlabs/vibatchium OpenAI key
sk-aaa…(25 chars, redacted)