Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51311 analyzed
7406 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- MEDIUM suspicious endpoint clayseal/clayseal-receipts 8.8.8.8
result = OcsfExporter(endpoint="https://8.8.8.8/ocsf", client=client).export( - HIGH dynamic exec clayseal/clayseal-receipts __import__()
monitoring=__import__( - HIGH dynamic exec Paoladev45/feedrecall new Function()
const load = new Function( - MEDIUM suspicious endpoint mindweft 1.1.1.1
"url": "https://1.1.1.1/mcp", - MEDIUM suspicious endpoint tomtom-international/tomtom-traffic-analytics-mcp 169.254.169.254 (cloud metadata)
"SELECT content FROM read_text('http://169.254.169.254/latest/meta-data/iam/security-credentials/')", - HIGH obfuscation Mr-remon219/search-boost dynamic require()/import()
const { agentConfigured: agentConfiguredFresh } = await import(`../lib/paths.mjs?claudeHome=${Date.now()}`) - HIGH dynamic exec ihuzaifashoukat/splicedeck eval()/exec()
return eval( - HIGH obfuscation dlxeva/canvas-prompt dynamic require()/import()
const server = await import('./mcp/server.mjs?browser-harness=' + Date.now()); - HIGH obfuscation dlxeva/canvas-prompt dynamic require()/import()
const scoped = await import(`./server.mjs?artifact-review-reader=${Date.now()}`); - HIGH committed secret rafapra3008/cervellaswarm OpenAI key
sk-aaa…(24 chars, redacted) - HIGH committed secret rafapra3008/cervellaswarm Anthropic key
sk-ant…(85 chars, redacted) - HIGH dynamic exec rafapra3008/cervellaswarm eval()/exec()
exec(compile(result.python_source, result.source_file, "exec"), ns) # noqa: S102 # nosec B102 - HIGH dynamic exec rafapra3008/cervellaswarm eval()/exec()
exec(code, namespace) # nosec B102 - HIGH dynamic exec rafapra3008/cervellaswarm pickle.loads()
restored = pickle.loads(pickle.dumps(exc)) # nosec B301 - HIGH dynamic exec rafapra3008/cervellaswarm eval()/exec()
exec(compile(result.python_source, result.source_file, "exec"), ns) # noqa: S102 # nosec B102