Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50100 analyzed
8073 re-analysis due
988 not analyzable
2 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187699
- MEDIUM suspicious endpoint buildinternet/releases 1.1.1.1
url: "https://1.1.1.1/hook", - MEDIUM suspicious endpoint buildinternet/releases amplitude.com (telemetry)
url: "https://amplitude.com/releases", - MEDIUM suspicious endpoint buildinternet/releases 1.1.1.1
const PUBLIC_HOOK_URL = "https://1.1.1.1/hook"; - MEDIUM suspicious endpoint buildinternet/releases discordapp.com
url: "https://discordapp.com/api/webhooks/987654321098765432/otherToken", - MEDIUM suspicious endpoint buildinternet/releases 8.8.8.8
body: JSON.stringify({ scope: "follows", url: "https://8.8.8.8/hook" }), - MEDIUM suspicious endpoint buildinternet/releases discord.com
"https://discord.com/api/webhooks/123456789012345678/abcdefghijklmnopqrstuvwxyz"; - MEDIUM suspicious endpoint buildinternet/releases 1.1.1.1
const PUBLIC_HOOK_URL = "https://1.1.1.1/hook"; - MEDIUM suspicious endpoint buildinternet/releases 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data/", - MEDIUM suspicious endpoint buildinternet/releases 1.1.1.1
url: "https://1.1.1.1/hook", - MEDIUM suspicious endpoint buildinternet/releases 169.254.169.254 (cloud metadata)
{ version: 2, releases: [{ feed: "https://169.254.169.254/feed.xml" }] }, - MEDIUM suspicious endpoint buildinternet/releases discord.com
? "https://discord.com/api/webhooks/…" - MEDIUM suspicious endpoint buildinternet/releases ptb.discord.com
expect(validateDiscordWebhookUrl("https://ptb.discord.com/api/webhooks/1/token")).toBeNull(); - MEDIUM suspicious endpoint buildinternet/releases canary.discord.com
validateDiscordWebhookUrl("https://canary.discord.com/api/webhooks/1/token-._ok"), - MEDIUM suspicious endpoint buildinternet/releases discordapp.com
"https://discordapp.com/api/webhooks/123456789012345678/abcdefghijklmnopqrstuvwxyz", - MEDIUM suspicious endpoint buildinternet/releases discord.com
"https://discord.com/api/webhooks/123456789012345678/abcdefghijklmnopqrstuvwxyz";