Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51314 analyzed
7403 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- MEDIUM suspicious endpoint ptrinh/freeport 172.32.0.1
expect(pick('https://172.32.0.1')).toBe('https://172.32.0.1'); - MEDIUM suspicious endpoint ptrinh/freeport 172.15.0.1
expect(pick('https://172.15.0.1')).toBe('https://172.15.0.1'); - HIGH dynamic exec ptrinh/freeport new Function()
new Function('window', SDK_SRC)(win); - HIGH committed secret ptrinh/freeport Google API key
AIzaSy…(39 chars, redacted) - HIGH committed secret ptrinh/freeport Google API key
AIzaSy…(39 chars, redacted) - MEDIUM suspicious endpoint productstein/holomime us.i.posthog.com (telemetry)
const POSTHOG_HOST = process.env.HOLOMIME_POSTHOG_HOST ?? "https://us.i.posthog.com"; - MEDIUM suspicious endpoint priyankark/lighthouse-mcp 169.254.169.254 (cloud metadata)
const blocked = await client.callTool({ name: 'run_audit', arguments: { url: 'http://169.254.169.254/' } }); - MEDIUM suspicious endpoint priyankark/lighthouse-mcp 169.254.169.254 (cloud metadata)
if (req.url === '/redirect') { res.writeHead(302, { location: 'http://169.254.169.254/latest/meta-data' }); res.end(); } - MEDIUM suspicious endpoint praveenc/llmstxt-doc-search 169.254.169.254 (cloud metadata)
expect(() => assertPublicHttpUrl("http://169.254.169.254/latest/meta-data/")).toThrow(URLValidationError); - MEDIUM suspicious endpoint prashantsinghmangat/tracebug-ai www.google-analytics.com (telemetry)
expect(isNoiseRequest('https://www.google-analytics.com/collect?v=1')).toBe(true); - HIGH dynamic exec pooriaarab/vibeshare new Function()
expect(() => new Function(js)).not.toThrow(); - HIGH dynamic exec pooriaarab/vibeshare new Function()
expect(() => new Function(js)).not.toThrow(); - MEDIUM suspicious endpoint polygraphso/litmus 1.1.1.1
await expect(assertPublicHttpUrl("http://1.1.1.1/mcp")).rejects.toThrow(/plaintext http/); - MEDIUM suspicious endpoint polygraphso/litmus 169.254.169.254 (cloud metadata)
await expect(assertPublicHttpUrl("http://169.254.169.254/latest/meta-data/")).rejects.toBeInstanceOf( - MEDIUM suspicious endpoint polydev-ai/polydev us.i.posthog.com (telemetry)
connect-src 'self' https://us.i.posthog.com https://oxhutuxkthdxvciytwmb.supabase.co wss: ws:;