Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51311 analyzed
7406 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH committed secret ghostwright/phantom Slack token
xoxb-t…(20 chars, redacted) - HIGH obfuscation stackmemoryai/stackmemory dynamic require()/import()
const { classifyScreenState } = require('${__dirname}/llm-decision.js'); - HIGH committed secret stackmemoryai/stackmemory Anthropic key
sk-ant…(39 chars, redacted) - HIGH credential in log stackmemoryai/stackmemory credential in log
console.log(`API Key loaded: ${(process.env.STACKMEMORY_LINEAR_API_KEY || process.env.LINEAR_API_KEY) ? 'Yes' : 'No'} (length: ${(process.env.STACKMEMORY_LINEAR_API_KEY || process.env.LINEAR_API_KEY)? - HIGH obfuscation stackmemoryai/stackmemory dynamic require()/import()
const { generateReflection } = await import('${reflectPath}'); - HIGH dynamic exec stackmemoryai/stackmemory vm exec
vm.runInNewContext(inlineMarkdownCode, sandbox); - HIGH committed secret google-searchconsole-mcp Google OAuth client secret
GOCSPX…(35 chars, redacted) - HIGH dynamic exec @sprigr/mcp-server new Function()
const ret = new Function(getStringFromWasm0(arg0, arg1)); - HIGH dynamic exec @sprigr/mcp-server new Function()
const ret = new Function(getStringFromWasm0(arg0, arg1)); - HIGH dynamic exec httuicom/httui new Function()
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); - HIGH obfuscation DimaUsenko/bastiondeck dynamic require()/import()
const store = await import(`../server/dist/store.js?case=${Date.now()}`); - MEDIUM suspicious endpoint @runsec/mcp 169.254.169.254 (cloud metadata)
'curl -i --max-time 3 "http://169.254.169.254/latest/meta-data/"' - HIGH dynamic exec zavoryn/debug-mind __import__()
mod = __import__(grammar_module, fromlist=["language"]) - MEDIUM suspicious endpoint knitli/codeweaver us.i.posthog.com (telemetry)
mock_telemetry.posthog_host = "https://us.i.posthog.com" - HIGH dynamic exec knitli/codeweaver pickle.loads()
restored = pickle.loads(data)