Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50108 analyzed
8067 re-analysis due
988 not analyzable
0 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187702
- HIGH committed secret melgarafael/DeskcommCRM Google OAuth client secret
GOCSPX…(28 chars, redacted) - HIGH credential in log melgarafael/DeskcommCRM credential in log
console.info(` login: ${EMAIL} / ${PASSWORD}`); - HIGH credential in log melgarafael/DeskcommCRM credential in log
console.log(` password: ${PASSWORD}`); - MEDIUM suspicious endpoint melgarafael/DeskcommCRM 129.121.45.100
env.NEXT_PUBLIC_APP_URL = "http://129.121.45.100:18080"; - HIGH dynamic exec retospect/precis-mcp __import__()
frontmatter=__import__( - MEDIUM suspicious endpoint retospect/precis-mcp 93.184.216.34
assert resolve_pinned_ip("http://93.184.216.34/") is None - MEDIUM suspicious endpoint retospect/precis-mcp 169.254.169.254 (cloud metadata)
"http://169.254.169.254/", # cloud metadata - MEDIUM suspicious endpoint retospect/precis-mcp 169.254.169.254 (cloud metadata)
evil = ["../../../admin", "RAshort", "http://169.254.169.254/", ""] - HIGH dynamic exec retospect/precis-mcp eval()/exec()
exec(compile(src, "<orig>", "exec"), ns_orig) - HIGH committed secret retospect/precis-mcp Slack token
xoxb-f…(15 chars, redacted) - HIGH dynamic exec GrandFatherPikhto/KiCadStamp unsafe yaml.load()
return yaml.load(stream, Loader=_SAFE_LOADER) - HIGH dynamic exec symkit-mcp eval()/exec()
exec(result["script"], namespace) # must not raise NameError - HIGH dynamic exec symkit-mcp eval()/exec()
exec(script, namespace) # must not raise NameError - HIGH obfuscation oleksandrdubyna88/dew_flow_creds_for_devs dynamic require()/import()
const { withTimeout } = require(${JSON.stringify(path.resolve(__dirname, '../withTimeout.js'))}); - HIGH dynamic exec oleksandrdubyna88/dew_flow_creds_for_devs new Function()
() => new Function('acquireVsCodeApi', script),