Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51314 analyzed
7403 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH obfuscation hegemonart/get-design-done dynamic require()/import()
const store = require(${JSON.stringify(storePath)}); - HIGH committed secret hegemonart/get-design-done Stripe live key
sk_liv…(28 chars, redacted) - HIGH committed secret hegemonart/get-design-done GitHub token
ghp_AA…(40 chars, redacted) - HIGH committed secret hegemonart/get-design-done OpenAI key
sk-Pro…(25 chars, redacted) - HIGH committed secret hegemonart/get-design-done private key
PEM private key block (redacted) - HIGH obfuscation hegemonart/get-design-done dynamic require()/import()
const rg = require(${JSON.stringify(modulePath)}); - HIGH obfuscation hegemonart/get-design-done dynamic require()/import()
const store = require(${JSON.stringify(storePath)}); - HIGH obfuscation hegemonart/get-design-done dynamic require()/import()
const sdk = await import(pathToFileURL(${JSON.stringify(indexPath)}).href); - HIGH obfuscation hegemonart/get-design-done dynamic require()/import()
const source = require(${JSON.stringify(sourcePath)}); - HIGH obfuscation hegemonart/get-design-done dynamic require()/import()
const store = require(${JSON.stringify(STORE_PATH)}); - HIGH obfuscation hegemonart/get-design-done dynamic require()/import()
const { BACKEND } = require(${JSON.stringify(backendPath)}); - HIGH obfuscation hegemonart/get-design-done dynamic require()/import()
assert.equal(typeof require(path.resolve(REPO_ROOT, `scripts/lib/collab/${f}.cjs`)), 'object', `${f} loads`); - HIGH obfuscation hegemonart/get-design-done dynamic require()/import()
const adapter = require(path.join(ADAPTER_DIR, `${spec.name}.cjs`)); - MEDIUM suspicious endpoint hegemonart/get-design-done discord.com
const env = { SLACK_WEBHOOK_URL: 'https://hooks.slack.com/services/x', DISCORD_WEBHOOK_URL: 'https://discord.com/api/webhooks/y' }; - HIGH obfuscation hegemonart/get-design-done dynamic require()/import()
const ib = require(${JSON.stringify(modulePath)});