Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51311 analyzed
7406 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH credential in log jongall45/frontrun-mcp-server credential in log
console.log(` Key: sig_••••••••${creds.api_key.slice(-8)}`); - HIGH dynamic exec ayato-labs/LogicHive __import__()
module = __import__(module_path, fromlist=[class_name]) - MEDIUM suspicious endpoint motozero/repofinder.io api.telegram.org
const response = await fetch(`https://api.telegram.org/bot${env.TELEGRAM_BOT_TOKEN}/sendMessage`, { - HIGH dynamic exec cheewee2000/cadgang vm exec
const gc = vm.runInNewContext('gc'); - HIGH obfuscation Paola3stefania/openBriefing dynamic require()/import()
const mirrorOnlineMod = await import(`../src/storage/db/mirror.js?t=${Date.now()}-1`); - MEDIUM suspicious endpoint inhabitants/sapiens-mcp 169.254.169.254 (cloud metadata)
bad("http://169.254.169.254/latest/meta-data"); // metadata endpoint clássico - MEDIUM suspicious endpoint inhabitants/sapiens-mcp 172.32.0.1
ok("http://172.32.0.1/x.png"); - HIGH obfuscation VirSanghavi/axis dynamic require()/import()
const { lockedAtomicWriteFile, withFileLock } = await import(${JSON.stringify( - HIGH obfuscation flujo-app/mcp-stdio-oauth dynamic require()/import()
const module = await import(`..${conditions.import.slice(1)}`); - MEDIUM suspicious endpoint LaloCornejo/JARVIS api.telegram.org
API_URL = "https://api.telegram.org/bot{token}" - MEDIUM over-broad oauth scope LaloCornejo/JARVIS gmail.modify
"https://www.googleapis.com/auth/gmail.modify", - HIGH dynamic exec LaloCornejo/JARVIS eval()/exec()
exec(code, safe_globals, safe_locals) - MEDIUM over-broad oauth scope LaloCornejo/JARVIS gmail.modify
"https://www.googleapis.com/auth/gmail.modify", - HIGH dynamic exec LaloCornejo/JARVIS eval()/exec()
return bool(eval(condition, {"__builtins__": {}}, safe_context)) - HIGH dynamic exec LaloCornejo/JARVIS eval()/exec()
exec(compile(code, "<sandbox>", "exec"), restricted_globals)