Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50020 analyzed
8131 re-analysis due
988 not analyzable
1 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6177
- dynamic exec 11826
- obfuscation 3575
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2548
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187620
- HIGH committed secret spectrayan/spector Slack token
xoxb-i…(23 chars, redacted) - HIGH committed secret tejasghutukade/stageflow OpenAI key
sk-aaa…(23 chars, redacted) - HIGH obfuscation onetapstudiogames/1f3d9 dynamic require()/import()
const { windowSnapshot } = await import(${JSON.stringify(windowUrl)}) - HIGH dynamic exec onetapstudiogames/1f3d9 new Function()
assert.doesNotThrow(() => new Function(WINDOW_JS)) - HIGH dynamic exec onetapstudiogames/1f3d9 new Function()
const relativeGap = new Function('return ' + source[0])() as - HIGH dynamic exec onetapstudiogames/1f3d9 new Function()
const run = new Function( - HIGH dynamic exec onetapstudiogames/1f3d9 new Function()
assert.doesNotThrow(() => new Function(WINDOW_JS)) - HIGH dynamic exec onetapstudiogames/1f3d9 new Function()
const isQuietPlace = new Function('return ' + source[0])() as (place: unknown) => boolean - HIGH dynamic exec onetapstudiogames/1f3d9 new Function()
return new Function(parts.join('\n\n'))() as ( - HIGH dynamic exec onetapstudiogames/1f3d9 new Function()
assert.doesNotThrow(() => new Function(CREDIT_BUY_JS)) - MEDIUM suspicious endpoint onetapstudiogames/1f3d9 8.8.8.8
['public bare IPv4 URL', fields => fields.set('url', 'https://8.8.8.8/tool'), /public https link.*public host.*try again/iu], - MEDIUM suspicious endpoint onetapstudiogames/1f3d9 169.254.169.254 (cloud metadata)
['link-local URL', fields => fields.set('url', 'https://169.254.169.254/latest/meta-data'), /public https link.*public host.*try again/iu], - HIGH suspicious skill script Ntizar/MasterMind suspicious bundled script
python3 -c "import manim" 2>/dev/null && ok "Manim $(manim --version 2>&1 | head -1)" || { fail "Manim not installed: pip install manim"; errors=$((errors+1)); } - MEDIUM suspicious endpoint Ntizar/MasterMind api.telegram.org
f"https://api.telegram.org/bot{tg_token}/getMe", - HIGH dynamic exec Ntizar/MasterMind eval()/exec()
exec(compile(open(path).read(), str(path), 'exec'), ns)