Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50066 analyzed
8097 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6178
- dynamic exec 11834
- obfuscation 3579
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187628
- HIGH committed secret headroomlabs-ai/headroom Anthropic key
sk-ant…(49 chars, redacted) - HIGH committed secret headroomlabs-ai/headroom Anthropic key
sk-ant…(32 chars, redacted) - HIGH dynamic exec yashdoke7/skeletongraph __import__()
__import__(mod) - HIGH suspicious skill script KnockOutEZ/wigolo suspicious bundled script
node -e 'const s=require("net").createServer();s.listen(0,"127.0.0.1",()=>{const p=s.address().port;s.close(()=>process.stdout.write(String(p)))});' - MEDIUM suspicious endpoint KnockOutEZ/wigolo 1.1.1.1
expect(guardFetchUrl('https://1.1.1.1/', 'url').ok).toBe(true); - MEDIUM suspicious endpoint KnockOutEZ/wigolo 172.32.0.1
const r = guardUrl('http://172.32.0.1/', 'url'); - MEDIUM suspicious endpoint KnockOutEZ/wigolo 172.15.0.1
const r = guardUrl('http://172.15.0.1/', 'url'); - MEDIUM suspicious endpoint KnockOutEZ/wigolo 8.8.8.8
const r = guardUrl('https://8.8.8.8/', 'url'); - MEDIUM suspicious endpoint KnockOutEZ/wigolo 169.254.169.254 (cloud metadata)
const r = guardFetchUrl('http://169.254.169.254/latest/meta-data/', 'url'); - MEDIUM suspicious endpoint KnockOutEZ/wigolo 169.254.169.254 (cloud metadata)
{ url: 'http://169.254.169.254/latest/meta-data/' }, - MEDIUM suspicious endpoint KnockOutEZ/wigolo 169.254.169.254 (cloud metadata)
const seedUrl = 'http://169.254.169.254/latest/meta-data/'; - MEDIUM suspicious endpoint KnockOutEZ/wigolo 169.254.169.254 (cloud metadata)
{ 'https://public.example.net/start': 'http://169.254.169.254/latest/meta-data/' }, - HIGH dynamic exec KnockOutEZ/wigolo new Function()
const runner = new Function( - MEDIUM suspicious endpoint KnockOutEZ/wigolo 169.254.169.254 (cloud metadata)
res.writeHead(302, { location: 'http://169.254.169.254/latest/meta-data/' }); - MEDIUM suspicious endpoint KnockOutEZ/wigolo 169.254.169.254 (cloud metadata)
jsonResponse({}, { status: 302, headers: { location: 'http://169.254.169.254/' } }),