Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51197 analyzed
7502 re-analysis due
995 not analyzable
0 not yet analyzed
4849 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12007
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190152
- HIGH credential in log alfredang/socialmediapost credential in log
console.log(`[seed] generated password (shown once): ${password}`); - HIGH credential in log alfredang/socialmediapost credential in log
console.log(`New password for ${r.email} (shown once): ${r.password}`); - MEDIUM suspicious endpoint good-boy4069/read-image 100.100.100.200 (cloud metadata)
"http://100.100.100.200/", - MEDIUM suspicious endpoint good-boy4069/read-image 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data/", - MEDIUM suspicious endpoint good-boy4069/read-image 8.8.8.8
assert validate_remote_url("https://8.8.8.8/path") == "https://8.8.8.8/path" - HIGH dynamic exec bbangert/ha-exception-debug eval()/exec()
value = eval(compiled, globs, locs) # noqa: S307 - the whole point of this tool - MEDIUM suspicious endpoint xcodethink/pixelcheck api.telegram.org
expect(url).toBe("https://api.telegram.org/botBOT_T/sendMessage"); - HIGH obfuscation xcodethink/pixelcheck dynamic require()/import()
const { AgentMemory } = require(${JSON.stringify( - MEDIUM suspicious endpoint xcodethink/pixelcheck 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data/", // AWS IMDS (link-local) - HIGH credential in log xcodethink/pixelcheck credential in log
log.info({ apiKey: "sk-ant-secret-12345" }, "calling API"); - HIGH obfuscation xcodethink/pixelcheck dynamic require()/import()
const { withFileLockSync } = require(${JSON.stringify( - HIGH dynamic exec xcodethink/pixelcheck new Function()
const factory = new Function( - HIGH committed secret xcodethink/pixelcheck Anthropic key
sk-ant…(33 chars, redacted) - HIGH obfuscation xcodethink/pixelcheck dynamic require()/import()
const { CostGuard } = require(${JSON.stringify( - MEDIUM suspicious endpoint xcodethink/pixelcheck api.telegram.org
await fetch(`https://api.telegram.org/bot${token}/sendMessage`, {