Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51308 analyzed
7409 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- MEDIUM suspicious endpoint growthmind-ai/growthmind eu-assets.i.posthog.com (telemetry)
assetsHost: "https://eu-assets.i.posthog.com", - MEDIUM suspicious endpoint growthmind-ai/growthmind eu.i.posthog.com (telemetry)
apiHost: "https://eu.i.posthog.com", - HIGH committed secret growthmind-ai/growthmind Slack token
xoxb-f…(29 chars, redacted) - MEDIUM suspicious endpoint growthmind-ai/growthmind us.i.posthog.com (telemetry)
host: "https://us.i.posthog.com", - HIGH committed secret growthmind-ai/growthmind Slack token
xoxb-s…(38 chars, redacted) - HIGH committed secret growthmind-ai/growthmind Slack token
xoxb-o…(40 chars, redacted) - HIGH committed secret growthmind-ai/growthmind Slack token
xoxb-o…(35 chars, redacted) - HIGH committed secret growthmind-ai/growthmind Slack token
xoxb-f…(29 chars, redacted) - HIGH dynamic exec shuishousong/zotero-ima-mcp unsafe yaml.load()
parsed = yaml.load(raw_yaml, Loader=_UniqueKeyLoader) if raw_yaml.strip() else {} - HIGH committed secret Taibur-Rahaman/Agent2Wp Slack token
xoxb-s…(22 chars, redacted) - MEDIUM over-broad oauth scope yuting0624/gemini-studio-mcp https://www.googleapis.com/auth/cloud-platform
"Run this once, then retry:\n `gcloud auth application-default login --scopes=https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/drive.readonly`", - MEDIUM over-broad oauth scope yuting0624/gemini-studio-mcp https://www.googleapis.com/auth/cloud-platform
"https://www.googleapis.com/auth/cloud-platform", - MEDIUM over-broad oauth scope yuting0624/gemini-studio-mcp https://www.googleapis.com/auth/cloud-platform
const SCOPES = ["https://www.googleapis.com/auth/cloud-platform"]; - MEDIUM over-broad oauth scope opensauria/sauria https://mail.google.com/
'https://mail.google.com/ https://www.googleapis.com/auth/calendar https://www.googleapis.com/auth/drive', - MEDIUM suspicious endpoint opensauria/sauria api.telegram.org
await secureFetch('https://api.telegram.org/bot/getMe');