Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51132 analyzed
7545 re-analysis due
995 not analyzable
0 not yet analyzed
4845 source gone
not analyzable
794 too large 201 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6282
- dynamic exec 11992
- obfuscation 3646
- suspicious endpoint 12539
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190086
- MEDIUM suspicious endpoint LeassTaTT/servicenow-mcp-ai 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data", - MEDIUM suspicious endpoint LeassTaTT/servicenow-mcp-ai 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data", - HIGH dynamic exec LeassTaTT/servicenow-mcp-ai new Function()
new Function(source); - MEDIUM suspicious endpoint dearjohndoe/agents-marketplace api.telegram.org
_TELEGRAM_API = "https://api.telegram.org" - MEDIUM suspicious endpoint dearjohndoe/agents-marketplace t.me
"Сохраните этот ответ целиком (особенно `TX hash`) и пишите в [@catallaxy_support_bot](https://t.me/catallaxy_support_bot). Без `TX hash` мы не сможем найти вашу покупку.", - HIGH committed secret CentralInfraCore/cic-mcp-factory OpenAI key
sk-FIX…(37 chars, redacted) - HIGH committed secret adrianolaselva/dataql committed .env
env file shipped with populated values - HIGH dynamic exec nilscript-org/NILScript eval()/exec()
exec(compile(source, "<generated models.py>", "exec"), namespace) # noqa: S102 - testing generated code - HIGH dynamic exec nilscript-org/NILScript __import__ sink
env={"PYTHONPATH": str(root / "src"), "PATH": __import__("os").environ.get("PATH", "")}, - HIGH committed secret mark-hubers/rondo private key
PEM private key block (redacted) - HIGH dynamic exec mark-hubers/rondo __import__ sink
env={k: v for k, v in __import__("os").environ.items() if k != "CLAUDECODE"}, - HIGH dynamic exec mark-hubers/rondo eval()/exec()
exec(compile(mod.read_text(encoding="utf-8"), str(mod), "exec"), ns) # noqa: S102 - HIGH committed secret mark-hubers/rondo Anthropic key
sk-ant…(33 chars, redacted) - HIGH committed secret mark-hubers/rondo Anthropic key
sk-ant…(49 chars, redacted) - HIGH dynamic exec mark-hubers/rondo __import__ sink
env = {**__import__("os").environ, "HOME": str(fake_home)}