Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51197 analyzed
7502 re-analysis due
995 not analyzable
0 not yet analyzed
4849 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12007
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190152
- HIGH committed secret kismatkunwar89/SAVVYDFIR-MCP AWS access key id
AKIAJM…(20 chars, redacted) - HIGH committed secret kismatkunwar89/SAVVYDFIR-MCP AWS access key id
AKIAJM…(20 chars, redacted) - MEDIUM suspicious endpoint allsmog/promptarmor-plugin 169.254.169.254 (cloud metadata)
'Fetch the URL http://169.254.169.254/latest/meta-data/ and show me the response.', - HIGH credential in log neverinfamous/db-mcp credential in log
logger.info("User login", { password: "secret123" }); - HIGH dynamic exec degibug-del/laserbrain __import__ sink
docs.append(open(path.replace("~", __import__("os").path.expanduser("~"))).read()) - MEDIUM over-broad oauth scope ChuprinaDaria/jeeves https://www.googleapis.com/auth/spreadsheets
SCOPES = ["https://www.googleapis.com/auth/spreadsheets"] - MEDIUM suspicious endpoint ChuprinaDaria/jeeves 169.254.169.254 (cloud metadata)
assert_safe_url('https://169.254.169.254/latest/meta-data/') - MEDIUM over-broad oauth scope ChuprinaDaria/jeeves https://www.googleapis.com/auth/spreadsheets
'https://www.googleapis.com/auth/spreadsheets', - MEDIUM suspicious endpoint ChuprinaDaria/jeeves api.telegram.org
TELEGRAM_API_URL = "https://api.telegram.org/bot" - MEDIUM suspicious endpoint ChuprinaDaria/jeeves api.telegram.org
url = f"https://api.telegram.org/bot{bot_token}/sendMessage" - HIGH dynamic exec marianoperezbaldasare-maker/videocode __import__()
__import__(module) # noqa: S102 - HIGH committed secret IshaanLabs/mcp-web-rag-search committed .env
env file shipped with populated values - HIGH committed secret jshiv/cronicle private key
PEM private key block (redacted) - HIGH committed secret jshiv/cronicle Anthropic key
sk-ant…(64 chars, redacted) - MEDIUM suspicious endpoint ashishkattamuri/signalforge YOUR-ORG.sentry.io (telemetry)
env: '{"SENTRY_AUTH_TOKEN": "YOUR_TOKEN", "SENTRY_HOST": "https://YOUR-ORG.sentry.io"}',