Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50022 analyzed
8130 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6177
- dynamic exec 11826
- obfuscation 3575
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2548
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187620
- HIGH committed secret frumu-ai/tandem GitHub fine-grained PAT
github…(39 chars, redacted) - HIGH dynamic exec allmonday/pydantic-resolve eval()/exec()
exec(code, ns, ns) - HIGH committed secret kubeview-mcp private key
PEM private key block (redacted) - HIGH obfuscation kubeview-mcp dynamic require()/import()
const { main } = await import(`file://${finalIndexPath}`); - HIGH dynamic exec strands-agents/sdk-python eval()/exec()
return eval(expression) - HIGH dynamic exec strands-agents/sdk-python pickle.loads()
@pytest.mark.parametrize("clone", [copy.deepcopy, lambda state: pickle.loads(pickle.dumps(state))]) - HIGH dynamic exec strands-agents/sdk-python eval()/exec()
return str(eval(expression)) - HIGH dynamic exec strands-agents/sdk-python eval()/exec()
return str(eval(expression)) - HIGH dynamic exec strands-agents/sdk-python __import__()
module = __import__(module_path, fromlist=["*"]) - MEDIUM suspicious endpoint shiahonb777/turn-mcp api.telegram.org
const urlObj = new URL(`https://api.telegram.org/bot${this.botToken}/sendMessage`); - MEDIUM suspicious endpoint Mintplex-Labs/anything-llm t.me
const BOTFATHER_URL = "https://t.me/BotFather"; - MEDIUM suspicious endpoint Mintplex-Labs/anything-llm t.me
to={`https://t.me/${config.bot_username}`} - MEDIUM suspicious endpoint Mintplex-Labs/anything-llm 123.123.123.123
expect(validateURL("123.123.123.123")).toBe("https://123.123.123.123"); - HIGH dynamic exec youichi-uda/blender-mcp-pro eval()/exec()
exec(code, namespace) - MEDIUM suspicious endpoint react-native-ai-devtools us.i.posthog.com (telemetry)
const host = "https://us.i.posthog.com";