Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50877 analyzed
7738 re-analysis due
994 not analyzable
1 not yet analyzed
4843 source gone
not analyzable
793 too large 201 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6279
- dynamic exec 11963
- obfuscation 3642
- suspicious endpoint 12517
- credential in log 718
- over-broad oauth scope 2539
- suspicious skill script 197
- bundled IDE extension 50
- skill file 189917
- HIGH dynamic exec rudraptpsingh/figbridge new Function()
return await page.evaluate(new Function(`return (async () => { ${script} })()`)); - HIGH dynamic exec keithyt06/quick-dingtalk-mcp new Function()
const extractDescription = new Function( - HIGH obfuscation keithyt06/quick-dingtalk-mcp dynamic require()/import()
const mod = await import(`./index.ts?cache=${Date.now()}-no-url`); - MEDIUM suspicious endpoint sridharandevcom/telegram-mcp-ts api.telegram.org
const API_BASE = "https://api.telegram.org"; - MEDIUM over-broad oauth scope alsgur9865-sketch/formforge-ai https://www.googleapis.com/auth/cloud-platform
creds, _ = google.auth.default(scopes=["https://www.googleapis.com/auth/cloud-platform"]) - HIGH obfuscation sh-ui-cli dynamic require()/import()
messages: (await import(\`./messages/\${locale}.json\`)).default, - HIGH obfuscation sh-ui-cli dynamic require()/import()
const mod = await import(`../${name}/styles.css.ts`); - HIGH dynamic exec Magnifico4625/locus new Function()
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); - HIGH credential in log edkdev/defi-trading-mcp credential in log
console.log(`Private Key: ${wallet.privateKey}`); - HIGH dynamic exec QuietFireAI/ClawFilters __import__()
limiter = __import__( - HIGH dynamic exec QuietFireAI/ClawFilters __import__()
__import__(_mod) - MEDIUM suspicious endpoint QuietFireAI/ClawFilters 159.65.241.102
API_BASE = os.environ.get("DEMO_API_BASE", "http://159.65.241.102:8000") - MEDIUM suspicious endpoint QuietFireAI/ClawFilters api.telegram.org
_TG_API = "https://api.telegram.org/bot{token}/{method}" - MEDIUM over-broad oauth scope Casius999/quantum-ads-mcp https://www.googleapis.com/auth/spreadsheets
"https://www.googleapis.com/auth/spreadsheets", - MEDIUM over-broad oauth scope Casius999/quantum-ads-mcp https://www.googleapis.com/auth/drive
"https://www.googleapis.com/auth/drive",