Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51197 analyzed
7502 re-analysis due
995 not analyzable
0 not yet analyzed
4849 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12007
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190152
- HIGH committed secret bawbel/bawbel-scanner Anthropic key
sk-ant…(35 chars, redacted) - HIGH credential in log b0ase/path402 credential in log
console.log('Deploying from address:', privateKey.toAddress().toString()) - HIGH credential in log b0ase/path402 credential in log
console.log('Deploying from:', privateKey.toAddress().toString()) - MEDIUM suspicious endpoint astafford8488/agentaegis-mcp 8.8.8.8
expect((await validateGitUrl("https://8.8.8.8/owner/repo")).valid).toBe(true); - MEDIUM suspicious endpoint astafford8488/agentaegis-mcp 169.254.169.254 (cloud metadata)
"https://169.254.169.254/latest/meta-data/", - HIGH obfuscation astafford8488/agentaegis-mcp base64 decode → exec sink
eval(atob(payload));`; - HIGH dynamic exec astafford8488/agentaegis-mcp eval()
eval(atob(payload));`; - MEDIUM suspicious endpoint astafford8488/agentaegis-mcp 169.254.169.254 (cloud metadata)
{ url: "http://169.254.169.254/latest/meta-data/", group: "E1", reason: "AWS metadata" }, - MEDIUM suspicious endpoint assafbar2/agentswitchboard.dev sentry.io (telemetry)
providerUrl: 'https://sentry.io', - MEDIUM suspicious endpoint assaf/expense 169.254.169.254 (cloud metadata)
fetchPublicUrl("http://169.254.169.254/latest/meta-data/"), - MEDIUM suspicious endpoint assaf/expense 169.254.169.254 (cloud metadata)
url: "http://169.254.169.254/latest/meta-data/", - MEDIUM suspicious endpoint assaf/expense 169.254.169.254 (cloud metadata)
await fetchRemoteImageImpl("http://169.254.169.254/latest/meta-data/"), - MEDIUM over-broad oauth scope assaf/expense gmail.modify
it("requests gmail.modify offline with consent and an S256 challenge", async () => { - MEDIUM over-broad oauth scope assaf/expense gmail.modify
"https://www.googleapis.com/auth/gmail.modify openid email"; - HIGH dynamic exec artvepa80/Agents-Hefesto eval()
eval(userInput);