Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51197 analyzed
7502 re-analysis due
995 not analyzable
0 not yet analyzed
4849 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12007
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190152
- HIGH dynamic exec StellarRequiem/Forest-Soul-Forge pickle.loads()
round_tripped = pickle.loads(pickle.dumps(sctx)) - HIGH obfuscation StellarRequiem/Forest-Soul-Forge base64 decode → exec sink
- CRITICAL: eval(atob(...)) obfuscation. - HIGH dynamic exec StellarRequiem/Forest-Soul-Forge __import__()
return importlib.__import__(name, *args, **kwargs) - HIGH dynamic exec StellarRequiem/Forest-Soul-Forge __import__ sink
"PATH": __import__("os").environ.get("PATH", ""), - HIGH dynamic exec StellarRequiem/Forest-Soul-Forge __import__ sink
"PATH": __import__("os").environ.get("PATH", ""), - HIGH dynamic exec StellarRequiem/Forest-Soul-Forge __import__ sink
"PATH": __import__("os").environ.get("PATH", ""), - HIGH dynamic exec StellarRequiem/Forest-Soul-Forge pickle.loads()
result = pickle.loads(stdout_bytes) - HIGH dynamic exec StellarRequiem/Forest-Soul-Forge pickle.loads()
result = pickle.loads(sandbox_result.result_pickle) - HIGH dynamic exec StellarRequiem/Forest-Soul-Forge __import__ sink
"PATH": __import__("os").environ.get("PATH", ""), - HIGH dynamic exec StellarRequiem/Forest-Soul-Forge pickle.loads()
return pickle.loads(raw) - HIGH obfuscation StellarRequiem/Forest-Soul-Forge base64 decode → exec sink
eval(atob(...)) obfuscation, etc.). No legitimate plugin - HIGH committed secret StellarRequiem/Forest-Soul-Forge GitHub fine-grained PAT
github…(33 chars, redacted) - HIGH committed secret StellarRequiem/Forest-Soul-Forge GitHub fine-grained PAT
github…(33 chars, redacted) - HIGH committed secret StellarRequiem/Forest-Soul-Forge GitHub fine-grained PAT
github…(33 chars, redacted) - HIGH committed secret neverinfamous/memory-journal-mcp GitHub token
ghp_se…(40 chars, redacted)