Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51308 analyzed
7409 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- MEDIUM suspicious endpoint ergoveritas1-alt/certscore.ai edge.fullstory.com (telemetry)
requestUrl: "https://edge.fullstory.com/s/settings/15TFZD/v1/web", - MEDIUM suspicious endpoint ergoveritas1-alt/certscore.ai www.google-analytics.com (telemetry)
requestUrl: "https://www.google-analytics.com/g/collect?v=2", - MEDIUM suspicious endpoint ergoveritas1-alt/certscore.ai edge.fullstory.com (telemetry)
const fullStoryUrl = "https://edge.fullstory.com/s/fs.js"; - MEDIUM suspicious endpoint ergoveritas1-alt/certscore.ai www.google-analytics.com (telemetry)
const googleUrl = "https://www.google-analytics.com/g/collect?tid=G-TEST"; - MEDIUM suspicious endpoint ergoveritas1-alt/certscore.ai www.google-analytics.com (telemetry)
requestUrl: "https://www.google-analytics.com/g/collect?v=2", - MEDIUM suspicious endpoint ergoveritas1-alt/certscore.ai www.google-analytics.com (telemetry)
requestUrl: "https://www.google-analytics.com/g/collect?v=2", - MEDIUM suspicious endpoint ergoveritas1-alt/certscore.ai api2.amplitude.com (telemetry)
const identity=identifyCrawlService(row('https://api2.amplitude.com/2/httpapi'))!; - MEDIUM suspicious endpoint ergoveritas1-alt/certscore.ai www.google-analytics.com (telemetry)
const analytics=identifyCrawlService(row('https://www.google-analytics.com/g/collect')); - MEDIUM suspicious endpoint ergoveritas1-alt/certscore.ai www.google-analytics.com (telemetry)
sourceEvidenceIds: ["policy:cookie#reject", "cookie:_ga", "request:https://www.google-analytics.com/g/collect"] - MEDIUM suspicious endpoint ergoveritas1-alt/certscore.ai edge.fullstory.com (telemetry)
"https://edge.fullstory.com/s/settings/15TFZD/v1/web", - MEDIUM suspicious endpoint ergoveritas1-alt/certscore.ai analytics.google.com (telemetry)
"https://analytics.google.com/g/collect?v=2", - MEDIUM suspicious endpoint ergoveritas1-alt/certscore.ai www.google-analytics.com (telemetry)
"vendor:Google Analytics|relationship:first_party|endpoint:first_party_collection_proxy|host:www.google-analytics.com|source_url:https://www.google-analytics.com/g/collect?v=2" - HIGH dynamic exec ergoveritas1-alt/certscore.ai new Function()
assert.doesNotThrow(() => new Function(script)); - HIGH dynamic exec ergoveritas1-alt/certscore.ai vm exec
vm.runInNewContext(buildConsentBootstrapScript(tag), { window, document, URL }); - MEDIUM suspicious endpoint ergoveritas1-alt/certscore.ai o1.ingest.de.sentry.io (telemetry)
const html = renderToStaticMarkup(<DataTransferDisclosure label="Sentry" context={context} requestUrls={["https://o1.ingest.de.sentry.io/api/2/envelope/"]}/>);