Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50100 analyzed
8073 re-analysis due
988 not analyzable
2 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187701
- HIGH dynamic exec streamient/streamient vm exec
vm.runInNewContext(dateFormatSource, context); - HIGH obfuscation streamient/streamient dynamic require()/import()
const { default: apiRoutes } = await import(`../routes/api.js?profile_test=${Date.now()}_${Math.random()}`); - HIGH obfuscation streamient/streamient dynamic require()/import()
const { default: apiRoutes } = await import(`../routes/api.js?byo_ai_test=${Date.now()}_${Math.random()}`); - HIGH obfuscation streamient/streamient dynamic require()/import()
const { default: adminRoutes } = await import(`../routes/admin.js?admin_user_export_test=${Date.now()}_${Math.random()}`); - HIGH obfuscation streamient/streamient dynamic require()/import()
const { default: adminRoutes } = await import(`../routes/admin.js?admin_settings_test=${Date.now()}_${Math.random()}`); - HIGH dynamic exec streamient/streamient vm exec
await vm.runInNewContext(source, context); - HIGH dynamic exec streamient/streamient new Function()
result[paramName] = new Function(`return ${value}`)(); - HIGH obfuscation nsasoft/nsauditor-ai dynamic require()/import()
const module = await import('../plugins/wsd_scanner.mjs?' + Date.now()); - HIGH obfuscation nsasoft/nsauditor-ai dynamic require()/import()
const { default: dnssdScanner } = await import('../plugins/dnssd-scanner.mjs?update=' + Date.now()); - MEDIUM suspicious endpoint hanzoai/ai 47.113.204.64
<iframe id="iframe" title={"iframe"} src={`https://47.113.204.64:23554/?userId=${this.props.account.name}`} width="100%" height={window.innerHeight - 195} frameBorder="no" /> - HIGH committed secret hanzoai/ai Anthropic key
sk-ant…(41 chars, redacted) - HIGH committed secret hanzoai/ai OpenAI key
sk-pro…(40 chars, redacted) - HIGH committed secret PradeepaRW/project-nova committed .env
env file shipped with populated values - HIGH committed secret PradeepaRW/project-nova committed .env
env file shipped with populated values - HIGH committed secret PradeepaRW/project-nova committed .env
env file shipped with populated values