Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50067 analyzed
8096 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6178
- dynamic exec 11834
- obfuscation 3579
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187628
- MEDIUM suspicious endpoint Aganium/agenium 194.5.206.180
const ECHO_AGENT_URL = 'https://194.5.206.180:8443'; - MEDIUM suspicious endpoint Aganium/agenium 185.204.169.26
{ name: 'echo', endpoint: 'https://185.204.169.26:9001' }, - MEDIUM suspicious endpoint Aganium/agenium 194.5.206.180
Endpoint: https://194.5.206.180:${PORT} - HIGH committed secret Aganium/agenium private key
PEM private key block (redacted) - MEDIUM suspicious endpoint Aganium/agenium 130.185.123.247
search: 'http://130.185.123.247:8080', - MEDIUM suspicious endpoint Aganium/agenium 185.204.169.26
const res = await fetch('http://185.204.169.26:3004/health', { - HIGH committed secret Aganium/agenium private key
PEM private key block (redacted) - HIGH committed secret Aganium/agenium private key
PEM private key block (redacted) - MEDIUM suspicious endpoint Pentagonal-ai/pentagonal t.me
rtsWith('http') ? tokenInfo.telegram : `https://t.me/${tokenInfo.telegram}`} target="_blank" rel="noopener noreferrer" title="Telegram" style={{ fontSize: 14, textDecoration: 'none', opacity: 0.6, tra - MEDIUM suspicious endpoint 3DUNLMTD/stylemcp api.telegram.org
const url = `https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage`; - MEDIUM suspicious endpoint 1clawAI/1claw-mcp pastebin.com
url: "https://pastebin.com/abc", - MEDIUM suspicious endpoint 1clawAI/1claw-mcp abc.ngrok.io
url: "https://abc.ngrok.io/webhook", - MEDIUM suspicious endpoint 0xdirectping/app api.telegram.org
url = f"https://api.telegram.org/bot{TELEGRAM_BOT_TOKEN}/sendMessage" - HIGH dynamic exec FusionAuth/fusionauth-mcp-api eval()
const zodSchema = eval(zodSchemaString); - HIGH dynamic exec FusionAuth/fusionauth-mcp-api eval()
const zodSchema = eval(zodSchemaString);