Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51311 analyzed
7406 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- MEDIUM suspicious endpoint sammysltd/MakerChecker 172.32.0.1
expect(assertSafeHttpUrl("http://172.32.0.1/x")).toBe("http://172.32.0.1/x"); // just outside /12 - MEDIUM suspicious endpoint sammysltd/MakerChecker 8.8.8.8
expect(assertSafeHttpUrl("http://8.8.8.8/x")).toBe("http://8.8.8.8/x"); - MEDIUM suspicious endpoint sammysltd/MakerChecker 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data/", // cloud metadata - HIGH credential in log sammysltd/MakerChecker credential in log
console.log(apiKey.plaintext); - HIGH committed secret sammysltd/MakerChecker private key
PEM private key block (redacted) - HIGH committed secret chrbailey/promptspeak-mcp-server OpenAI key
sk-rea…(25 chars, redacted) - HIGH committed secret chrbailey/promptspeak-mcp-server OpenAI key
sk-rea…(26 chars, redacted) - HIGH suspicious skill script Fluory/claude-sync-kit suspicious bundled script
curl -fsSL https://claude.ai/install.sh | bash || \ - HIGH credential in log SejalPatel01/LexiGuard credential in log
console.log(`[SERVER ACTION] GEMINI_API_KEY environment variable detected: ${apiKeyExists}`); - HIGH credential in log SejalPatel01/LexiGuard credential in log
console.log(`[SERVER ACTION] GEMINI_API_KEY environment variable detected: ${apiKeyExists}`); - HIGH dynamic exec hermes98761234/webgpu-agent new Function()
const fn = new Function('"use strict"; return (async () => { ' + e.data + ' })()'); - HIGH dynamic exec sergei-roska/agent-forge eval()
$result = eval(base64_decode('${base64Payload}')); - HIGH dynamic exec sergei-roska/agent-forge eval()
$result = eval(base64_decode('${base64Payload}')); - HIGH dynamic exec sergei-roska/agent-forge eval()
$result = eval(base64_decode('${base64Payload}')); - HIGH dynamic exec sergei-roska/agent-forge eval()
$result = eval(base64_decode('${base64Payload}'));