Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51197 analyzed
7502 re-analysis due
995 not analyzable
0 not yet analyzed
4849 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12007
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190152
- HIGH dynamic exec aryxnsdfs/token-diet __import__()
__import__(mod) - MEDIUM suspicious endpoint nbialk/chess-mcp eu.i.posthog.com (telemetry)
const host = process.env.POSTHOG_HOST ?? "https://eu.i.posthog.com"; - HIGH committed secret hemang-doshi/agent-memory Slack token
xoxb-s…(21 chars, redacted) - HIGH obfuscation ParadoxInfinite/oriel dynamic require()/import()
const mod = await import(/* @vite-ignore */ `${BASE}/api/themes/${t.file}`) - MEDIUM suspicious endpoint tuannguyen14/SpectreWeb-AI 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data/", - MEDIUM suspicious endpoint tuannguyen14/SpectreWeb-AI 169.254.169.254 (cloud metadata)
"Try SSRF: http://localhost, http://169.254.169.254", - MEDIUM suspicious endpoint tuannguyen14/SpectreWeb-AI 169.254.169.254 (cloud metadata)
"http://169.254.169.254", - MEDIUM suspicious endpoint tuannguyen14/SpectreWeb-AI 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data/", - HIGH committed secret toro-guapo/trestle Stripe live key
sk_liv…(32 chars, redacted) - HIGH committed secret toro-guapo/trestle GitHub token
ghp_aa…(40 chars, redacted) - HIGH obfuscation adarshp14/relay dynamic require()/import()
await $`node --input-type=module --eval ${`await import(${JSON.stringify(spec)});`}` - MEDIUM over-broad oauth scope adarshp14/relay https://www.googleapis.com/auth/drive
scopes: ["https://www.googleapis.com/auth/drive"], - MEDIUM over-broad oauth scope adarshp14/relay https://www.googleapis.com/auth/drive
expect(Object.keys(scopes)).toContain("https://www.googleapis.com/auth/drive"); - HIGH dynamic exec adarshp14/relay new Function()
const execute = new Function( - HIGH dynamic exec adarshp14/relay new Function()
expect(() => new Function(out)).not.toThrow();