Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50108 analyzed
8067 re-analysis due
988 not analyzable
0 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187702
- HIGH credential in log civdotiq/civ.iq credential in log
console.log(`URL: ${endpoint.url.replace(apiKey, 'API_KEY_HIDDEN')}`); - MEDIUM suspicious endpoint chrismcdermut/proletariat posthog.com (telemetry)
docs: 'https://posthog.com/docs/api', - MEDIUM suspicious endpoint chrismcdermut/proletariat app.posthog.com (telemetry)
url: 'https://app.posthog.com/api', - MEDIUM suspicious endpoint chrismcdermut/proletariat api.telegram.org
return `https://api.telegram.org/bot${this.token}/${method}` - MEDIUM suspicious endpoint chrismcdermut/proletariat app.posthog.com (telemetry)
'<%= config.bin %> tools add api posthog --url https://app.posthog.com/api --auth POSTHOG_API_KEY --description "PostHog analytics API" --docs https://posthog.com/docs/api', - MEDIUM over-broad oauth scope chrischall/gogcli-mcp gmail.modify
scopes: ['https://www.googleapis.com/auth/gmail.modify', 'https://www.googleapis.com/auth/drive'], - MEDIUM over-broad oauth scope chrischall/gogcli-mcp https://www.googleapis.com/auth/drive
params: '{"fields":"id"}', body: '{"name":"f"}', scope: 'https://www.googleapis.com/auth/drive', - HIGH committed secret chrischall/gogcli-mcp Google API key
AIzaSy…(39 chars, redacted) - MEDIUM over-broad oauth scope chrischall/gogcli-mcp gmail.modify
scopes: ['https://www.googleapis.com/auth/gmail.modify'], - MEDIUM suspicious endpoint chrischall/gemini-mcp 169.254.169.254 (cloud metadata)
'https://169.254.169.254/latest/meta-data/', - HIGH dynamic exec cherchyk/MCPBrowser eval()
const tools = eval(toolsCode); - MEDIUM over-broad oauth scope cherchyk/MCPBrowser https://mail.google.com/
url: () => 'https://mail.google.com/mail/u/0/#inbox' - MEDIUM over-broad oauth scope cherchyk/MCPBrowser https://mail.google.com/
const page = mockPage('https://mail.google.com/mail/u/0/#inbox'); - MEDIUM over-broad oauth scope cherchyk/MCPBrowser https://mail.google.com/
url: () => 'https://mail.google.com/mail/u/0/#inbox' - MEDIUM over-broad oauth scope cherchyk/MCPBrowser https://mail.google.com/
const page = mockPage('https://mail.google.com/mail/u/0/#inbox');