Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51224 analyzed
7479 re-analysis due
995 not analyzable
0 not yet analyzed
4849 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12010
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190157
- HIGH dynamic exec Krishita17/MCP-Model-context-protocol pickle.loads()
data = pickle.loads(base64.b64decode(token)) - HIGH committed secret Krishita17/MCP-Model-context-protocol GitHub token
ghp_R3…(42 chars, redacted) - MEDIUM suspicious endpoint Krishita17/MCP-Model-context-protocol 169.254.169.254 (cloud metadata)
payload = "http://169.254.169.254/latest/meta-data/iam/security-credentials/" - MEDIUM suspicious endpoint omeirhaeghe/agentspace api.telegram.org
r = httpx.get(f"https://api.telegram.org/bot{token}/getUpdates", timeout=15) - MEDIUM suspicious endpoint omeirhaeghe/agentspace api.telegram.org
f"https://api.telegram.org/bot{token}/sendMessage", - MEDIUM suspicious endpoint omeirhaeghe/agentspace api.telegram.org
f"https://api.telegram.org/bot{token}/sendDocument", - MEDIUM suspicious endpoint Axmetov999/binance-trading-agent-mcp api.telegram.org
const TELEGRAM_API = "https://api.telegram.org"; - MEDIUM suspicious endpoint Axmetov999/binance-trading-agent-mcp api.telegram.org
const TELEGRAM_API = "https://api.telegram.org"; - MEDIUM over-broad oauth scope Liruns/marudesk https://www.googleapis.com/auth/cloud-platform
'https://www.googleapis.com/auth/cloud-platform https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile', - HIGH committed secret Liruns/marudesk Google OAuth client secret
GOCSPX…(35 chars, redacted) - MEDIUM over-broad oauth scope Liruns/marudesk https://www.googleapis.com/auth/cloud-platform
scope: 'https://www.googleapis.com/auth/cloud-platform', - HIGH committed secret Liruns/marudesk OpenAI key
sk-pro…(28 chars, redacted) - HIGH committed secret Liruns/marudesk Anthropic key
sk-ant…(37 chars, redacted) - MEDIUM suspicious endpoint OldJii/mcp-dock 8.8.8.8
'https://8.8.8.8/dns-query', // Google DoH - MEDIUM suspicious endpoint OldJii/mcp-dock 1.1.1.1
'https://1.1.1.1/dns-query', // Cloudflare DoH