Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51193 analyzed
7507 re-analysis due
995 not analyzable
0 not yet analyzed
4848 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12007
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190152
- MEDIUM suspicious endpoint JCrossman/can-fed-camp-mcp 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data/", - MEDIUM suspicious endpoint JCrossman/can-fed-camp-mcp 169.254.169.254 (cloud metadata)
notify_target: "http://169.254.169.254/latest/meta-data", - HIGH committed secret AlpharomeroJL/reticle Anthropic key
sk-ant…(31 chars, redacted) - HIGH committed secret AlpharomeroJL/reticle Anthropic key
sk-ant…(32 chars, redacted) - HIGH dynamic exec gashel01/kernelmcp __import__()
__import__(module) - HIGH dynamic exec gashel01/kernelmcp eval()/exec()
exec(code, {}) # noqa: S102 — benchmark sandboxless tool, mirrors execute_code's interface - HIGH dynamic exec kamiimeteor/cca-f-dojo new Function()
const buildPracticeResume = new Function( - HIGH dynamic exec kamiimeteor/cca-f-dojo new Function()
const renderFactory = new Function('t', 'esc', 'md', 'LTR', - HIGH dynamic exec kamiimeteor/cca-f-dojo vm exec
vm.runInNewContext(`${keysMatch[0]}${fnMatch[0]}`, sandbox, { filename: 'looksLikeArchive.js' }); - HIGH dynamic exec kamiimeteor/cca-f-dojo new Function()
const I18N = new Function(read('assets/data/i18n.js') + ';return I18N')(); - HIGH dynamic exec kamiimeteor/cca-f-dojo new Function()
const QUESTIONS = new Function(read('assets/data/questions.js') + ';return QUESTIONS')(); - MEDIUM suspicious endpoint alfredang/socialmediapost t.me
const url = messageId && chatId.startsWith("@") ? `https://t.me/${chatId.slice(1)}/${messageId}` : ""; - MEDIUM suspicious endpoint alfredang/socialmediapost api.telegram.org
const API = "https://api.telegram.org"; - MEDIUM suspicious endpoint alfredang/socialmediapost discord.com
throw new Error("That doesn't look like a Discord webhook URL (https://discord.com/api/webhooks/…)"); - MEDIUM suspicious endpoint alfredang/socialmediapost discord.com
placeholder: "https://discord.com/api/webhooks/…",