Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51314 analyzed
7403 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH dynamic exec zycaskevin/Vault-for-LLM eval()/exec()
exec(compile(raw, str(path), "exec"), module.__dict__) # noqa: S102 - fixed reviewed bytes - HIGH dynamic exec zycaskevin/Vault-for-LLM eval()/exec()
exec(compile(raw, "<subject-v5-sibling>", "exec"), module.__dict__) # noqa: S102 - HIGH dynamic exec zycaskevin/Vault-for-LLM eval()/exec()
exec(compile(raw, "<subject-v4-sibling>", "exec"), module.__dict__) # noqa: S102 - HIGH dynamic exec ksaitor/teamcp new Function()
const fn = new Function( - HIGH obfuscation ksaitor/teamcp dynamic require()/import()
const mod = (await import(`./${entry.name}/index.ts`)) as { - MEDIUM suspicious endpoint ksaitor/teamcp api.telegram.org
const API_BASE = "https://api.telegram.org"; - MEDIUM suspicious endpoint ksaitor/teamcp t.me
href={`https://t.me/${channel.botUsername}`} - MEDIUM suspicious endpoint matthewjmcbridejr-code/mcharness api.telegram.org
TELEGRAM_API_BASE = "https://api.telegram.org" - MEDIUM over-broad oauth scope matthewjmcbridejr-code/mcharness https://www.googleapis.com/auth/cloud-platform
scopes=["https://www.googleapis.com/auth/cloud-platform"] - HIGH dynamic exec matthewjmcbridejr-code/mcharness eval()/exec()
result = eval(expr, {"__builtins__": {}}, {}) - MEDIUM suspicious endpoint matthewjmcbridejr-code/mcharness api.telegram.org
API_URL = f"https://api.telegram.org/bot{TOKEN}" if TOKEN else None - HIGH dynamic exec quilin-ai/agent-bridge new Function()
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); - HIGH dynamic exec precis-finance/precis-mcp __import__()
mod = __import__(mod_path, fromlist=[cls_name]) - MEDIUM over-broad oauth scope chienchuanw/gmail-mcp gmail.modify
"https://www.googleapis.com/auth/gmail.modify", - MEDIUM over-broad oauth scope chienchuanw/gmail-mcp gmail.modify
expect(GMAIL_SCOPES).toContain("https://www.googleapis.com/auth/gmail.modify");