Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50067 analyzed
8096 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6178
- dynamic exec 11834
- obfuscation 3579
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187628
- HIGH dynamic exec Chen-zexi/open-ptc-agent __import__()
module = __import__(module_name, fromlist=[class_name]) - HIGH committed secret Kymo-MCP/mcpcan private key
PEM private key block (redacted) - HIGH committed secret Kymo-MCP/mcpcan private key
PEM private key block (redacted) - HIGH committed secret Kymo-MCP/mcpcan private key
PEM private key block (redacted) - HIGH dynamic exec ant4g0nist/lisa.py eval()/exec()
exec(compile(code, GENERATED_PY, "exec")) - HIGH dynamic exec agentscope-ai/agentscope-runtime __import__()
return __import__(name, *args, **kwargs) - HIGH dynamic exec agentscope-ai/agentscope-runtime __import__ sink
"DASHSCOPE_API_KEY" not in __import__("os").environ, - MEDIUM suspicious endpoint agentscope-ai/agentscope-runtime 1.2.3.4
assert url == "http://1.2.3.4:9090" - HIGH dynamic exec agentscope-ai/agentscope-runtime eval()/exec()
exec(code, namespace) - HIGH obfuscation context-space/context-space dynamic require()/import()
const Content = (await import(`./content.${locale}.mdx`)).default - HIGH obfuscation context-space/context-space dynamic require()/import()
const Content = (await import(`./content.${locale}.mdx`)).default - MEDIUM over-broad oauth scope xing5/mcp-google-sheets https://www.googleapis.com/auth/spreadsheets
SCOPES = ['https://www.googleapis.com/auth/spreadsheets', 'https://www.googleapis.com/auth/drive'] - HIGH obfuscation xu-xiang/everything-claude-code-zh dynamic require()/import()
const utils = require('${utilsPath.replace(/'/g, "\\'")}'); - HIGH dynamic exec github0null/eide eval()
let disp_val = eval(`${num}${operator}${item.var_disp_inf.operate.val}`) - HIGH dynamic exec github0null/eide indirect eval
}();try{n=n||Function("return this")()||(0,eval)("this")}catch(t){"object"==typeof window&&(n=window)}t.exports=n}])}))},6369:function(t,e,n){"use strict";n(4633);var r=Object.freeze({});function o(t)