Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50067 analyzed
8096 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6178
- dynamic exec 11834
- obfuscation 3579
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187628
- MEDIUM suspicious endpoint minhoyoo-iotrust/WAIaaS 169.254.169.254 (cloud metadata)
await expect(validateUrlSafety('http://169.254.169.254/metadata')).rejects.toThrow(); - MEDIUM suspicious endpoint minhoyoo-iotrust/WAIaaS discord.com
await channel.initialize({ discord_webhook_url: 'https://discord.com/api/webhooks/fake/token' }); - MEDIUM suspicious endpoint minhoyoo-iotrust/WAIaaS discord.com
if (key === 'notifications.discord_webhook_url') return 'https://discord.com/api/webhooks/test'; - MEDIUM suspicious endpoint minhoyoo-iotrust/WAIaaS 169.254.169.254 (cloud metadata)
body: JSON.stringify({ url: 'http://169.254.169.254/latest', chain: 'ethereum' }), - MEDIUM suspicious endpoint minhoyoo-iotrust/WAIaaS discord.com
discord_webhook_url: 'https://discord.com/api/webhooks/123/abc', - MEDIUM suspicious endpoint minhoyoo-iotrust/WAIaaS api.telegram.org
<a href="https://api.telegram.org" target="_blank" rel="noopener noreferrer">Telegram Bot API</a>. - MEDIUM suspicious endpoint minhoyoo-iotrust/WAIaaS t.me
<a href="https://t.me/BotFather" target="_blank" rel="noopener noreferrer">@BotFather</a> - HIGH dynamic exec AuraFriday/mcp-link new Function()
scripts to execute`)),i.forEach(o=>{try{new Function(o.textContent)()}catch(o){s[e("error")](...t("error","❌ Failed to execute script due to CSP or other error:",o))}o.remove()});const r=[...o.querySe - HIGH dynamic exec EchoingVesper/mcp-task-orchestrator __import__()
module = __import__(module_path, fromlist=[class_name]) - HIGH dynamic exec EchoingVesper/mcp-task-orchestrator __import__()
module = __import__(module_path, fromlist=[class_name]) - HIGH dynamic exec EchoingVesper/mcp-task-orchestrator eval()/exec()
exec(open('standalone_migration_test.py').read()) - HIGH dynamic exec EchoingVesper/mcp-task-orchestrator __import__()
__import__(package) - HIGH dynamic exec EchoingVesper/mcp-task-orchestrator __import__()
__import__(import_name) - HIGH dynamic exec EchoingVesper/mcp-task-orchestrator __import__()
__import__(dep) - HIGH dynamic exec EchoingVesper/mcp-task-orchestrator __import__()
__import__(module_name)