Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51314 analyzed
7403 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH dynamic exec jamesaphoenix/tx concat require()
const mod = await import("f" + "s") - HIGH credential in log sherault/kanban credential in log
console.log(` Password: ${password}`); - MEDIUM suspicious endpoint renyancheng/synora 101.43.52.61
"http://101.43.52.61," - MEDIUM suspicious endpoint William-Lu-stack/Flawless api.telegram.org
url = f"https://api.telegram.org/bot{token}/sendMessage" - HIGH dynamic exec RajX-dev/N3MO __import__()
mod = __import__(module_name) - MEDIUM suspicious endpoint Rinava/MarkSight www.google-analytics.com (telemetry)
`connect-src 'self' https://www.google-analytics.com https://region1.google-analytics.com https://*.google-analytics.com https://*.vercel-insights.com https://*.vercel-scripts.com https://api.github.c - MEDIUM over-broad oauth scope tocodex-ai/tocodex-community https://www.googleapis.com/auth/cloud-platform
scopes: ["https://www.googleapis.com/auth/cloud-platform"], - HIGH dynamic exec Jinansh230705/ncert-mcp eval()
NCERT_TEXTBOOK_CHAPTERS = eval(`(${objectString})`); - HIGH dynamic exec Jinansh230705/ncert-mcp eval()
const NCERT_TEXTBOOK_CHAPTERS = eval(`(${objectString})`); - HIGH dynamic exec Jinansh230705/ncert-mcp eval()
const NCERT_TEXTBOOK_CHAPTERS = eval(`(${objectString})`); - HIGH dynamic exec Jinansh230705/ncert-mcp eval()
const NCERT_TEXTBOOK_CHAPTERS = eval(`(${objectString})`); - HIGH dynamic exec codeyogi911/able new Function()
new Function(javascript) - HIGH dynamic exec bdhxhxhhxhxhxhhxjxhxhxhxhx2-del/codex-photoshop-psd-automation eval()
expect(eval(`"${literal}"`)).toBe(nasty); - HIGH dynamic exec bdhxhxhhxhxhxhhxjxhxhxhxhx2-del/codex-photoshop-psd-automation new Function()
return new Function(`return ${trimmed}`)() as unknown; - MEDIUM suspicious endpoint bdhxhxhhxhxhxhhxjxhxhxhxhx2-del/codex-photoshop-psd-automation api-eu.mixpanel.com (telemetry)
const DEFAULT_MIXPANEL_API_HOST = 'https://api-eu.mixpanel.com';