Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50067 analyzed
8096 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6178
- dynamic exec 11834
- obfuscation 3579
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187628
- MEDIUM suspicious endpoint Defenter-AI/defenter-proxy 172.15.255.255
["http://172.15.255.255/", true], - HIGH committed secret Defenter-AI/defenter-proxy SendGrid key
SG.nge…(69 chars, redacted) - HIGH committed secret Defenter-AI/defenter-proxy Stripe live key
sk_liv…(41 chars, redacted) - HIGH committed secret Defenter-AI/defenter-proxy GitHub token
gho_98…(42 chars, redacted) - HIGH committed secret Defenter-AI/defenter-proxy AWS access key id
AKIA23…(20 chars, redacted) - HIGH committed secret Defenter-AI/defenter-proxy Stripe live key
sk_liv…(42 chars, redacted) - HIGH committed secret Defenter-AI/defenter-proxy Stripe live key
sk_liv…(42 chars, redacted) - HIGH committed secret Defenter-AI/defenter-proxy private key
PEM private key block (redacted) - HIGH obfuscation DanielBlomma/cortex dynamic require()/import()
const toolsModule = await import(`${pathToFileURL(path.join(bundle, "tools.mjs")).href}?profile=${profileName}`); - HIGH dynamic exec Damien829/aipaygen eval()
ching '${url}'`);if(200===status)return eval(body);throw new Error(`Failed to load split bundle from URL: ${url}\n${body}`)})}},543,[544,545]); - MEDIUM suspicious endpoint DHEBP/dero-mcp-server 82.65.143.182
export const PUBLIC_DAEMON_BASE = 'http://82.65.143.182:10102' - MEDIUM suspicious endpoint DHEBP/dero-mcp-server 82.65.143.182
const DEFAULT_URL = "http://82.65.143.182:10102"; - MEDIUM suspicious endpoint DHEBP/dero-mcp-server 82.65.143.182
const DEFAULT_DAEMON_URL = 'http://82.65.143.182:10102' - HIGH obfuscation CloakedAgent/cloaked dynamic require()/import()
import(`@/content/docs/${slug}.mdx`).catch(() => - HIGH credential in log Clawdio777/verity credential in log
console.log(`[stripe-webhook] ✓ ${credits} credits added to ${apiKey} for ${email}`);