Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50022 analyzed
8130 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6177
- dynamic exec 11826
- obfuscation 3575
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2548
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187620
- MEDIUM suspicious endpoint oomol-lab/open-connector 100.100.100.200 (cloud metadata)
"http://100.100.100.200/", - MEDIUM suspicious endpoint oomol-lab/open-connector 93.184.216.34
await guarded("https://93.184.216.34/"); - MEDIUM suspicious endpoint oomol-lab/open-connector 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data/", - HIGH obfuscation oomol-lab/open-connector dynamic require()/import()
const module = (await import(`../src/providers/${service}/definition.ts`)) as ProviderDefinitionModule; - HIGH obfuscation azmartone67/dchub-mcp-server dynamic require()/import()
await import(`../scripts/${name}.mjs`); - HIGH dynamic exec azmartone67/dchub-mcp-server eval()
return !eval(m[1].replace(/\bargs\b/g, 'args')); - HIGH obfuscation azmartone67/dchub-mcp-server dynamic require()/import()
return await import("../mpp-hook.mjs?t=" + Math.random()); - HIGH dynamic exec azmartone67/dchub-mcp-server new Function()
const v = new Function(...names, 'return (' + expr + ');')(...names.map((n) => DESC_SCOPE[n])); - HIGH committed secret NeuralTrust/TrustGate OpenAI key
sk-sup…(23 chars, redacted) - MEDIUM suspicious endpoint pma1999/agent-studio 169.254.169.254 (cloud metadata)
() => assertSafeMcpUrl(new URL('https://169.254.169.254/latest/meta-data'), { - HIGH committed secret leonardoprimero/bruriah private key
PEM private key block (redacted) - HIGH dynamic exec leonardoprimero/bruriah unsafe yaml.load()
data = yaml.load(raw, Loader=_StrictYamlLoader) - HIGH dynamic exec MadGapun/PBP __import__()
or list(__import__( - HIGH dynamic exec MadGapun/PBP __import__()
m = __import__(mod_name) - HIGH dynamic exec MadGapun/PBP eval()/exec()
version = eval(r.stdout.strip())