Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50064 analyzed
8099 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6178
- dynamic exec 11834
- obfuscation 3579
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187628
- MEDIUM suspicious endpoint guglxni/VyapaarClaw api.telegram.org
assert notifier._base_url == "https://api.telegram.org/bottok" - MEDIUM suspicious endpoint guglxni/VyapaarClaw api.telegram.org
TELEGRAM_API_BASE = "https://api.telegram.org" - HIGH dynamic exec darthblanc/agentic-file-explorer eval()/exec()
type=eval(ARGUMENTS[arg]["type"]), - MEDIUM suspicious endpoint pcdkd/nosocial-protocol us.i.posthog.com (telemetry)
posthog.init('phc_E7PPN9bVfNBJaVCqaxfdYxhzxJiCV3iz4js4Wb8FwDv',{api_host:'https://us.i.posthog.com',defaults:'2026-01-30',person_profiles:'identified_only'}) - MEDIUM suspicious endpoint pcdkd/nosocial-protocol us.i.posthog.com (telemetry)
host: process.env.POSTHOG_HOST || "https://us.i.posthog.com", - HIGH committed secret annondeveloper/ui-kit Stripe live key
sk_liv…(32 chars, redacted) - MEDIUM suspicious endpoint friendlygeorge/posthog-mcp-server app.posthog.com (telemetry)
"Get one at https://app.posthog.com/settings/user-api-keys" - MEDIUM suspicious endpoint friendlygeorge/posthog-mcp-server us.i.posthog.com (telemetry)
const POSTHOG_HOST = process.env.POSTHOG_HOST || "https://us.i.posthog.com"; - HIGH credential in log a2z2k26/semantic-memory-mcp credential in log
logger.info(`Bridge auth token: ${this.authToken}`); - HIGH dynamic exec a2z2k26/tts-stt-voice-mcp __import__()
__import__(dep) - HIGH dynamic exec a2z2k26/tts-stt-voice-mcp eval()/exec()
return eval(condition) - HIGH dynamic exec a2z2k26/tts-stt-voice-mcp pickle.loads()
return pickle.loads(row[0]) - HIGH dynamic exec sinhphamvj/agentic-mcp-gateway __import__ sink
"PATH": __import__("os").environ.get("PATH", ""), - HIGH committed secret SaputraUta/lgtm-oncall-mcp committed .env
env file shipped with populated values - HIGH committed secret ctxr-dev/memory Anthropic key
sk-ant…(35 chars, redacted)