Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51224 analyzed
7479 re-analysis due
995 not analyzable
0 not yet analyzed
4849 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12010
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190157
- HIGH credential in log paichart/paichart credential in log
console.log('accessToken:', accessToken); - MEDIUM suspicious endpoint zeta-chain/cli us.i.posthog.com (telemetry)
export const POSTHOG_ENDPOINT = "https://us.i.posthog.com"; - MEDIUM over-broad oauth scope sebastianall1977/gmail-mcp gmail.modify
const scope = encodeURIComponent("https://www.googleapis.com/auth/gmail.readonly https://www.googleapis.com/auth/gmail.modify"); - MEDIUM over-broad oauth scope sebastianall1977/gmail-mcp gmail.modify
'https://www.googleapis.com/auth/gmail.modify', - MEDIUM over-broad oauth scope sebastianall1977/gmail-mcp gmail.modify
"https://www.googleapis.com/auth/gmail.modify", - HIGH dynamic exec magenie33/quality-dimension-generator new Function()
var deprecatedfn = new Function( - HIGH credential in log kesslerio/attio-mcp-server credential in log
logger.warn('Sensitive debug', { password: 'hunter2' }); - HIGH committed secret kesslerio/attio-mcp-server committed .env
env file shipped with populated values - HIGH dynamic exec jirispilka/actors-mcp-server new Function()
var makeValidate = new Function( - HIGH credential in log jekakos/mcp-user-data-enrichment credential in log
console.log(`Arguments: firstName=${firstName}, lastName=${lastName}, birthDate=${birthDate}, email=${email}, password=${password}, text=${text}`); - HIGH committed secret huuthangntk/claude-vision-mcp-server Anthropic key
sk-ant…(31 chars, redacted) - HIGH committed secret huuthangntk/claude-vision-mcp-server Anthropic key
sk-ant…(31 chars, redacted) - HIGH committed secret hollaugo/tutorials Slack token
xoxb-y…(19 chars, redacted) - HIGH committed secret hollaugo/tutorials Slack token
xoxb-y…(30 chars, redacted) - HIGH committed secret hollaugo/tutorials Slack token
xoxb-y…(30 chars, redacted)