Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50108 analyzed
8067 re-analysis due
988 not analyzable
0 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187702
- MEDIUM suspicious endpoint timdevai/proteus 169.254.169.254 (cloud metadata)
"Submit http://169.254.169.254/ and http://127.0.0.1 in URL fields.", - MEDIUM over-broad oauth scope timdevai/proteus https://www.googleapis.com/auth/documents
"https://www.googleapis.com/auth/documents", - MEDIUM over-broad oauth scope timdevai/proteus https://www.googleapis.com/auth/spreadsheets
"https://www.googleapis.com/auth/spreadsheets", - MEDIUM over-broad oauth scope timdevai/proteus https://www.googleapis.com/auth/drive
"https://www.googleapis.com/auth/drive", - MEDIUM over-broad oauth scope timdevai/proteus gmail.modify
"https://www.googleapis.com/auth/gmail.modify", - MEDIUM suspicious endpoint testery/claude-plugin us.i.posthog.com (telemetry)
DEFAULT_POSTHOG_HOST = 'https://us.i.posthog.com' - HIGH hidden prompt testery/claude-plugin skill: skill-exfil (low)
secret→sink: 3. After the dashboard exits, render the final per-test summary using the format from `testery-report-test-run`. Include the run URL on the header line (see "Testery URLs" below): - HIGH hidden prompt testery/claude-plugin skill: skill-exfil
secret→sink: 2. **REST API**: POST to the alerts endpoint on `https://api.testery.io` (see Testery API docs). Construct the call with `curl` using `Authorization: Bearer $TESTERY_TOKEN`. - HIGH obfuscation dragocz1995/orca dynamic require()/import()
const Database = require(${JSON.stringify(sqlite)}); - HIGH obfuscation dragocz1995/orca dynamic require()/import()
const { openDb } = await import('${dbUrl}'); - HIGH obfuscation dragocz1995/orca dynamic require()/import()
const { register } = await import(`${pluginEntry}?test=${importNonce++}`) as { register: (ctx: unknown) => void }; - MEDIUM suspicious endpoint dragocz1995/orca 1.1.1.1
if (value.endsWith('/next')) return new Response('', { status: 302, headers: { location: 'https://1.1.1.1/final' } }); - MEDIUM suspicious endpoint dragocz1995/orca 93.184.216.34
url: 'http://93.184.216.34/page', prompt: 'What is the title?', - HIGH obfuscation dragocz1995/orca dynamic require()/import()
const helper = await import(`file://${HELPER_SOURCE}`); - HIGH obfuscation dragocz1995/orca dynamic require()/import()
const mod = await import(`${pathToFileURL(entry).href}?probe=1`) as {