Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51311 analyzed
7406 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH dynamic exec jame-ri/cst2026-skill-mcp setTimeout(string)
setTimeout("delayLoad()", 100); - HIGH dynamic exec jame-ri/cst2026-skill-mcp setTimeout(string)
setInterval("testScroll()",50) - HIGH dynamic exec jame-ri/cst2026-skill-mcp setTimeout(string)
setTimeout("checkReady();",1); - HIGH dynamic exec jame-ri/cst2026-skill-mcp setTimeout(string)
setTimeout("showDef(0);",100); - HIGH dynamic exec jame-ri/cst2026-skill-mcp setTimeout(string)
setTimeout( "Query()", 1 ); - HIGH dynamic exec jame-ri/cst2026-skill-mcp indirect eval
goog.loadFileSync_(f);if(g){(function(){(0,eval)(g+"\n//# sourceURL="+f)}).call(goog.global);if(goog.global.$gwtExport&&goog.global.$gwtExport.$jscomp&&!goog.global.$gwtExport.$jscomp.transpile)throw - HIGH dynamic exec jame-ri/cst2026-skill-mcp eval()
null==goog.hasBadLetScoping){try{var a=!eval('"use strict";let x = 1; function f() { return typeof x; };f() == "number";')}catch(b){a=!1}goog.hasBadLetScoping=a}return goog.hasBadLetScoping};goog.work - HIGH dynamic exec jame-ri/cst2026-skill-mcp setTimeout(string)
setTimeout("insertWhenBodyReady();",100); - HIGH dynamic exec jame-ri/cst2026-skill-mcp eval()
var sValue=eval("document.searchForm"+nForm+".searchString.value"); - HIGH dynamic exec jame-ri/cst2026-skill-mcp setTimeout(string)
setTimeout("sendAveInfo();",100); - HIGH dynamic exec jame-ri/cst2026-skill-mcp setTimeout(string)
setTimeout("syncInit()",1); - HIGH dynamic exec jame-ri/cst2026-skill-mcp eval()
eval(sOnClick); - HIGH dynamic exec jame-ri/cst2026-skill-mcp setTimeout(string)
setTimeout("updateAvenueIfNeeded();", 2000); - HIGH dynamic exec jame-ri/cst2026-skill-mcp setTimeout(string)
setTimeout("delayReload();",5000); - HIGH dynamic exec jame-ri/cst2026-skill-mcp setTimeout(string)
setTimeout("delayLoad()", 100);