Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51311 analyzed
7406 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- MEDIUM suspicious endpoint cyanheads/docgen-mcp-server 169.254.169.254 (cloud metadata)
fetchPdfGuarded('https://169.254.169.254/latest/meta-data', 1000, 1000, ctx), - HIGH dynamic exec Co-Engram/Co-Engram eval()
const regex: RegExp = eval(match![1]!); - HIGH dynamic exec Co-Engram/Co-Engram new Function()
const fn = new Function("CO_ENGRAM", "CO_ENGRAM_T", "window", "document", TABS_RUNTIME + "\nreturn CO_ENGRAM_ENGRAMS;"); - HIGH dynamic exec Co-Engram/Co-Engram vm exec
vm.runInNewContext(I18N_RUNTIME, sandbox); - HIGH obfuscation omar-dulaimi/supawatch dynamic require()/import()
const mod = await import(`file://${file}`); - HIGH obfuscation omar-dulaimi/supawatch dynamic require()/import()
const mod = await import(`file://${file}`); - HIGH obfuscation omar-dulaimi/supawatch dynamic require()/import()
const mod = await import(`file://${file}`); - HIGH obfuscation omar-dulaimi/supawatch dynamic require()/import()
const mod = await import(`file://${serverFile}`); - HIGH obfuscation omar-dulaimi/supawatch dynamic require()/import()
const fMod = await import(`file://${fFile}`); - HIGH obfuscation omar-dulaimi/supawatch dynamic require()/import()
const arbMod = await import(`file://${arbFile}`); - HIGH suspicious skill script mouse114514/Xadeus-QQ-MCP suspicious bundled script
curl -fsSL https://get.docker.com | sh - HIGH committed secret retz8/a2ui-github GitHub fine-grained PAT
github…(47 chars, redacted) - HIGH committed secret retz8/a2ui-github GitHub fine-grained PAT
github…(47 chars, redacted) - MEDIUM suspicious endpoint exe-ai-productions/exe-ai-terminal 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data/", # the cloud metadata address - HIGH dynamic exec reaatech/mcp-gateway eval()
eval(script: string, options?: { keys?: string[]; arguments?: string[] }): Promise<unknown>;