Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50108 analyzed
8067 re-analysis due
988 not analyzable
0 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187702
- MEDIUM suspicious endpoint kivo360/OmoiOS us.i.posthog.com (telemetry)
POSTHOG_HOST = "https://us.i.posthog.com" - HIGH committed secret VKirill/agent-consult OpenAI key
sk-som…(29 chars, redacted) - MEDIUM suspicious endpoint ywatanabe1989/scitex-notification api.telegram.org
TELEGRAM_API_BASE = "https://api.telegram.org/bot{token}" - MEDIUM suspicious endpoint ywatanabe1989/scitex-notification api.telegram.org
TELEGRAM_API_BASE = "https://api.telegram.org/bot{token}" - HIGH dynamic exec ralfbecher/orionbelt-semantic-layer unsafe yaml.load()
else yaml.load(path.read_text()) - HIGH dynamic exec ralfbecher/orionbelt-semantic-layer eval()/exec()
exec(compile(block, f"{self.GUIDE}#block{index}", "exec"), {"conn": conn}) - HIGH dynamic exec ralfbecher/orionbelt-semantic-layer __import__()
__import__(pkg) - HIGH dynamic exec ralfbecher/orionbelt-semantic-layer unsafe yaml.load()
data = yaml.load(SOURCE_MODEL.read_text()) - HIGH obfuscation YoonSuHyeon/mindcairn dynamic require()/import()
const mod = await import(`../../../instances/${tag}/notion-rules.ts`); - HIGH obfuscation YoonSuHyeon/mindcairn dynamic require()/import()
const mod = await import(`../instances/${tag}/notion-rules.ts`); - MEDIUM suspicious endpoint inclusionAI/AEnvironment 6.3.209.180
AENV_URL = os.getenv("AENV_SYSTEM_URL", "http://6.3.209.180") - HIGH dynamic exec inclusionAI/AEnvironment eval()/exec()
exec(code, {"__builtins__": __builtins__}, local_vars) - HIGH dynamic exec inclusionAI/AEnvironment eval()/exec()
exec(func_code, local_ns) - MEDIUM suspicious endpoint Ye-Yu-Mo/AI-SRE-Agent 47.92.153.60
AGENT_ENDPOINT: "http://47.92.153.60:9090", - MEDIUM over-broad oauth scope mbettan/PocketRAG https://www.googleapis.com/auth/cloud-platform
scopes=["https://www.googleapis.com/auth/cloud-platform"]