Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51314 analyzed
7403 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH dynamic exec keeperdotsh/keeper.sh eval()
eval(script: string, numberOfKeys: number, ...arguments_: string[]): Promise<unknown>; - HIGH dynamic exec keeperdotsh/keeper.sh eval()
eval(script: string, numberOfKeys: number, ...arguments_: string[]): Promise<unknown>; - HIGH dynamic exec keeperdotsh/keeper.sh eval()
eval(script: string, numberOfKeys: number, ...arguments_: string[]): Promise<unknown>; - HIGH dynamic exec keeperdotsh/keeper.sh eval()
eval(script: string, numberOfKeys: number, ...arguments_: string[]): Promise<unknown>; - MEDIUM suspicious endpoint keeperdotsh/keeper.sh www.google-analytics.com (telemetry)
`connect-src 'self' ${googleAdsHosts} https://www.google-analytics.com https://cdn.visitors.now https://e.visitors.now`, - HIGH dynamic exec emircbngl/tarhan __import__()
mod = __import__(module) - HIGH dynamic exec emircbngl/tarhan __import__()
versions[name] = __import__(name).__version__ - HIGH dynamic exec ilovewalking7/lp-section-studio indirect eval
meta = (0, eval)("(" + literal + ")"); - HIGH dynamic exec shaoqiuyuavailable/text-llm-vision __import__()
__import__(mod) - MEDIUM suspicious endpoint gatewerk/gatewerk eu.i.posthog.com (telemetry)
await fetch("https://eu.i.posthog.com/capture/", { - MEDIUM suspicious endpoint gatewerk/gatewerk eu.i.posthog.com (telemetry)
const phHost = process.env.PUBLIC_POSTHOG_HOST || "https://eu.i.posthog.com"; - HIGH committed secret gatewerk/gatewerk Slack token
xoxb-o…(20 chars, redacted) - MEDIUM suspicious endpoint gatewerk/gatewerk api.telegram.org
webhook_url: "https://api.telegram.org/bot999:XYZ/sendMessage?chat_id=-100789", - MEDIUM suspicious endpoint gatewerk/gatewerk 93.184.216.34
await expect(validateWebhookUrlWithDns("https://93.184.216.34/hook")).resolves.toBeUndefined(); - MEDIUM suspicious endpoint gatewerk/gatewerk api.telegram.org
const telegramUrl = "https://api.telegram.org/bot999:NONOK/sendMessage?chat_id=-100777";