Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51308 analyzed
7409 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- MEDIUM suspicious endpoint n1byn1kt/apitap 93.184.216.35
headers: { 'location': 'http://93.184.216.35/redirected' }, - MEDIUM suspicious endpoint n1byn1kt/apitap 169.254.169.254 (cloud metadata)
headers: { 'location': 'http://169.254.169.254/latest/meta-data' }, - MEDIUM suspicious endpoint n1byn1kt/apitap 93.184.216.34
const skill = makeSkill('http://93.184.216.34'); // Public IP - MEDIUM suspicious endpoint n1byn1kt/apitap 93.184.216.34
baseUrl: 'http://93.184.216.34', // Public IP to bypass SSRF - MEDIUM suspicious endpoint n1byn1kt/apitap 169.254.169.254 (cloud metadata)
res.writeHead(302, { Location: 'http://169.254.169.254/latest/meta-data/' }); - MEDIUM suspicious endpoint n1byn1kt/apitap 169.254.169.254 (cloud metadata)
assert.ok(!isAllowedUrl('http://169.254.169.254/latest/meta-data')); - MEDIUM suspicious endpoint n1byn1kt/apitap cdn.segment.com (telemetry)
JSON.stringify(signSkillFileAs(makeSkill({ domain: 'cdn.segment.com', baseUrl: 'https://cdn.segment.com' }), key, 'self'))); - MEDIUM suspicious endpoint n1byn1kt/apitap cdn.segment.com (telemetry)
const skill = makeSkill({ domain: 'cdn.segment.com', baseUrl: 'https://cdn.segment.com' }); - MEDIUM suspicious endpoint n1byn1kt/apitap api.mixpanel.com (telemetry)
examples: { request: { url: 'https://api.mixpanel.com/v1/events', headers: {} }, responsePreview: null }, - MEDIUM suspicious endpoint n1byn1kt/apitap cdn.segment.com (telemetry)
signSkillFileAs(makeSkill({ domain: 'cdn.segment.com', baseUrl: 'https://cdn.segment.com' }), signingKey, 'self'), - MEDIUM suspicious endpoint n1byn1kt/apitap 169.254.169.254 (cloud metadata)
url: 'http://169.254.169.254/latest/meta-data', - MEDIUM suspicious endpoint n1byn1kt/apitap o123.ingest.sentry.io (telemetry)
url: 'https://o123.ingest.sentry.io/envelope', - MEDIUM suspicious endpoint n1byn1kt/apitap google-analytics.com (telemetry)
url: 'https://google-analytics.com/collect', - HIGH dynamic exec JordanRO2/idamesh eval()/exec()
exec(compile(code, "<exec_python>", "exec"), namespace) - HIGH dynamic exec JordanRO2/idamesh __import__()
namespace[mod] = __import__(mod)