Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50022 analyzed
8130 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6177
- dynamic exec 11826
- obfuscation 3575
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2548
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187620
- HIGH dynamic exec BigVik193/reddit-ads-mcp-api new Function()
var makeValidate = new Function( - HIGH dynamic exec BigVik193/reddit-ads-mcp new Function()
var makeValidate = new Function( - MEDIUM suspicious endpoint the-basilisk-ai/squad-mcp eu.i.posthog.com (telemetry)
host: process.env.POSTHOG_HOST ?? "https://eu.i.posthog.com", - HIGH committed secret imboard-ai/ai-dossier private key
PEM private key block (redacted) - HIGH credential in log i18n-agent/mcp-client credential in log
console.log(` - API key preserved: ${mergedConfig.mcpServers['i18n-agent'].env.I18N_AGENT_API_KEY}`); - MEDIUM suspicious endpoint ankimcp/anki-mcp-server 169.254.169.254 (cloud metadata)
url: "http://169.254.169.254/latest/meta-data/", - MEDIUM suspicious endpoint ankimcp/anki-mcp-server 169.254.169.254 (cloud metadata)
url: "http://169.254.169.254/latest/meta-data/", - MEDIUM suspicious endpoint ankimcp/anki-mcp-server abc.ngrok.io
const context1 = createMockContext("https://abc.ngrok.io"); - MEDIUM suspicious endpoint ankimcp/anki-mcp-server xyz789.ngrok.io
const context2 = createMockContext("https://xyz789.ngrok.io"); - MEDIUM suspicious endpoint ankimcp/anki-mcp-server abc123.ngrok.io
const context1 = createMockContext("https://abc123.ngrok.io"); - MEDIUM suspicious endpoint ankimcp/anki-mcp-server abc123.ngrok.io
cli.box("Ngrok Tunnel Active", "https://abc123.ngrok.io"); - MEDIUM suspicious endpoint observer-protocol/at-directory 169.254.169.254 (cloud metadata)
res.writeHead(302, { Location: 'https://169.254.169.254/latest/meta-data/' }); - HIGH obfuscation frumu-ai/tandem dynamic require()/import()
moduleNames.map((name) => [name, require(join(directory, `${name}.js`))]) - HIGH committed secret frumu-ai/tandem Slack token
xoxb-g…(18 chars, redacted) - HIGH committed secret frumu-ai/tandem Slack token
xoxb-g…(18 chars, redacted)