Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51224 analyzed
7479 re-analysis due
995 not analyzable
0 not yet analyzed
4849 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12010
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190157
- MEDIUM suspicious endpoint attenlabs/hotato 1.1.1.1
assert cap._validate_download_url("http://1.1.1.1/rec.wav") == \ - MEDIUM suspicious endpoint attenlabs/hotato 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data/iam/security-credentials/", - MEDIUM suspicious endpoint wardenhood/Warden 172.32.0.1
expect(validateWebhookUrl("http://172.32.0.1")).toBe(true); - MEDIUM suspicious endpoint wardenhood/Warden 172.15.0.1
expect(validateWebhookUrl("http://172.15.0.1")).toBe(true); - MEDIUM suspicious endpoint wardenhood/Warden 169.254.169.254 (cloud metadata)
expect(validateWebhookUrl("http://169.254.169.254/latest/meta-data")).toBe(false); - MEDIUM suspicious endpoint wardenhood/Warden 172.32.0.1
expect(validateWebhookUrl("http://172.32.0.1")).toBe(true); - MEDIUM suspicious endpoint wardenhood/Warden 172.15.0.1
expect(validateWebhookUrl("http://172.15.0.1")).toBe(true); - MEDIUM suspicious endpoint wardenhood/Warden 169.254.169.254 (cloud metadata)
expect(validateWebhookUrl("http://169.254.169.254/latest/meta-data")).toBe(false); - HIGH obfuscation percena/memfuse dynamic require()/import()
const freshModule = await import('../dist/shared/config.js?update=' + Date.now()); - HIGH obfuscation percena/memfuse dynamic require()/import()
const { loadConfig } = await import('../dist/shared/config.js?t=' + Date.now()); - HIGH dynamic exec mandarwagh9/perch eval()
try { const x = eval('1+1'); return { json: { eval: x } }; } - HIGH dynamic exec mandarwagh9/perch constructor escape
viaCtx: probe(() => ctx.constructor.constructor('return this.process')()), - MEDIUM suspicious endpoint huaqing0/clash-control-mcp 223.5.5.5
dns: { enable: true, listen: '127.0.0.1:1053', ipv6: false, nameserver: ['https://223.5.5.5/dns-query'] }, - MEDIUM suspicious endpoint huaqing0/clash-control-mcp 223.5.5.5
nameserver: ['https://223.5.5.5/dns-query'], - MEDIUM suspicious endpoint huaqing0/clash-control-mcp 223.5.5.5
nameserver: opts.dnsNameservers ?? ['https://223.5.5.5/dns-query'],