Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51193 analyzed
7507 re-analysis due
995 not analyzable
0 not yet analyzed
4848 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12007
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190152
- MEDIUM suspicious endpoint Jo-Tsu/link mixpanel.com (telemetry)
"https://mixpanel.com/api/query/segmentation", - MEDIUM suspicious endpoint Jo-Tsu/link us.posthog.com (telemetry)
return str(profile.get("base_url") or "https://us.posthog.com").rstrip("/") - MEDIUM suspicious endpoint Jo-Tsu/link amplitude.com (telemetry)
"https://amplitude.com/api/2/annotations", - MEDIUM suspicious endpoint Jo-Tsu/link mixpanel.com (telemetry)
"https://mixpanel.com/api/app/me", - MEDIUM suspicious endpoint Jo-Tsu/link us.posthog.com (telemetry)
base = str(creds.get("base_url") or "https://us.posthog.com").rstrip("/") - MEDIUM suspicious endpoint Jo-Tsu/link api.telegram.org
f"https://api.telegram.org/bot{token}/getMe", timeout=15 - HIGH obfuscation reaatech/funcdock dynamic require()/import()
const handlerModule = await import(`${handlerPath}?update=${Date.now()}`); - MEDIUM over-broad oauth scope Hardt-LLC/AgentPack delete_repo
denyTools: ["delete_repo"], - HIGH obfuscation dcierra/DarwinRelay dynamic require()/import()
const { createFederation: freshCreate } = await import(`../lib/federation.mjs?ping=${Date.now()}`); - MEDIUM suspicious endpoint canyonlabz/mcp-perf-suite api.datadoghq.com (telemetry)
DD_API_BASE_URL = os.getenv("DD_API_BASE_URL", "https://api.datadoghq.com") - MEDIUM suspicious endpoint canyonlabz/mcp-perf-suite api.datadoghq.com (telemetry)
DD_API_BASE_URL = os.getenv("DD_API_BASE_URL", "https://api.datadoghq.com") - MEDIUM suspicious endpoint canyonlabz/mcp-perf-suite api.datadoghq.com (telemetry)
DD_API_BASE_URL = os.getenv("DD_API_BASE_URL", "https://api.datadoghq.com") - MEDIUM suspicious endpoint akawolfcito/facilitador-stellar 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data", - HIGH dynamic exec ATDev-Inc/uemcp eval()/exec()
exec(compile(code, "<harness>", "exec"), {}) - HIGH dynamic exec iikarus/Dragon-Brain eval()/exec()
exec( # noqa: S102