Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51160 analyzed
7536 re-analysis due
994 not analyzable
0 not yet analyzed
4848 source gone
not analyzable
794 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6282
- dynamic exec 11998
- obfuscation 3646
- suspicious endpoint 12540
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190134
- MEDIUM over-broad oauth scope tszaks/ghub https://www.googleapis.com/auth/spreadsheets
export const SHEETS_SCOPE = 'https://www.googleapis.com/auth/spreadsheets'; - MEDIUM over-broad oauth scope tszaks/ghub https://www.googleapis.com/auth/drive
export const DRIVE_FULL_SCOPE = 'https://www.googleapis.com/auth/drive'; - MEDIUM over-broad oauth scope tszaks/ghub https://mail.google.com/
'https://mail.google.com/', - HIGH dynamic exec ywatanabe1989/scitex-io unsafe yaml.load()
loaded = yaml.load(f) - HIGH dynamic exec ywatanabe1989/scitex-io pickle.loads()
return pickle.loads(pickled_bytes.tobytes()) - HIGH dynamic exec ywatanabe1989/scitex-io pickle.loads()
return pickle.loads(data.tobytes()) - HIGH dynamic exec ywatanabe1989/scitex-io pickle.loads()
return pickle.loads(data.tobytes()) - HIGH dynamic exec ywatanabe1989/scitex-io eval()/exec()
found_paths = _natsorted(_glob(eval(glob_pattern), recursive=recursive)) - HIGH obfuscation Abhishekkumar2021/mcp-servers dynamic require()/import()
const store = await import(`../dist/store.js?${Date.now()}`); - HIGH obfuscation Abhishekkumar2021/mcp-servers dynamic require()/import()
const { fetchSafe } = await import(`../dist/client.js?${Date.now()}`); - HIGH committed secret Abhishekkumar2021/mcp-servers GitHub fine-grained PAT
github…(37 chars, redacted) - HIGH dynamic exec IFC-UIDAHO/Cambium_AI eval()/exec()
exec(compile(ast.Module(body=[fn], type_ignores=[]), DOCTOR, "exec"), ns) - HIGH obfuscation bottobot/touchdesigner-mcp-server dynamic require()/import()
T[t] = await import(`../tools/${t}.js`); - HIGH obfuscation tathagat22/slipstream dynamic require()/import()
const sd = require(`${dir}/secdiff.js`); - HIGH obfuscation tathagat22/slipstream dynamic require()/import()
const c = require(`${dir}/cache.js`);