Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51311 analyzed
7406 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH credential in log JustineDevs/premortem credential in log
console.log(" Password: " + Java.use('java.lang.String').$new(password)); - HIGH credential in log JustineDevs/premortem credential in log
console.log(" Password: " + Java.use('java.lang.String').$new(password)); - MEDIUM over-broad oauth scope alexanderkrauck/email-server https://mail.google.com/
GMAIL_MAIL_SCOPE = "https://mail.google.com/" - MEDIUM suspicious endpoint Apex-Foundation/copilot-mcp t.me
- Telegram: https://t.me/apex_accelerator - MEDIUM suspicious endpoint JaviGala/web-perception-mcp 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data", - HIGH dynamic exec hihihhi/quant-research-vault __import__()
__import__(dep) - MEDIUM over-broad oauth scope BarnsL/WebOps-Console https://mail.google.com/
gmail: "https://mail.google.com/", - HIGH obfuscation Arakiss/nahuali dynamic require()/import()
require(response.ok, `${path} returned HTTP ${response.status}: ${text}`); - HIGH dynamic exec euuuuuuan/baton-public new Function()
const fn = new Function(`${cleaned}\n; return (${callExpr});`); - MEDIUM suspicious endpoint euuuuuuan/baton-public 169.254.169.254 (cloud metadata)
["cloud metadata", "http://169.254.169.254/latest/meta-data/"], - MEDIUM suspicious endpoint euuuuuuan/baton-public 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data/", - MEDIUM suspicious endpoint euuuuuuan/baton-public api.telegram.org
expect(url).toBe(`https://api.telegram.org/bot${BOT_TOKEN}/sendMessage`); - MEDIUM suspicious endpoint euuuuuuan/baton-public api.telegram.org
const url = `https://api.telegram.org/bot${this.token}/sendMessage`; - MEDIUM suspicious endpoint euuuuuuan/baton-public api.telegram.org
const res = await this.fetchImpl(`https://api.telegram.org/bot${this.token}/${method}`, { - HIGH committed secret euuuuuuan/baton-public OpenAI key
sk-SEC…(30 chars, redacted)