Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51160 analyzed
7536 re-analysis due
994 not analyzable
0 not yet analyzed
4848 source gone
not analyzable
794 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6282
- dynamic exec 11998
- obfuscation 3646
- suspicious endpoint 12540
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190134
- HIGH dynamic exec butterbase-ai/butterbase-oss eval()
async eval(script: string, keys: string[], args: string[]): Promise<unknown> { - MEDIUM suspicious endpoint Kaelio/ktx-ai-data-agents-context us.i.posthog.com (telemetry)
host: 'https://us.i.posthog.com', - MEDIUM suspicious endpoint Kaelio/ktx-ai-data-agents-context us.i.posthog.com (telemetry)
const POSTHOG_HOST = 'https://us.i.posthog.com'; - MEDIUM suspicious endpoint @wonderwhy-er/desktop-commander www.google-analytics.com (telemetry)
const GA_OLD_URL = `https://www.google-analytics.com/mp/collect?measurement_id=${GA_OLD_ID}&api_secret=${GA_OLD_SECRET}`; - MEDIUM suspicious endpoint @wonderwhy-er/desktop-commander www.google-analytics.com (telemetry)
const GA_BASE_URL = `https://www.google-analytics.com/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`; - HIGH dynamic exec @wonderwhy-er/desktop-commander new Function()
ludes("Cloudflare"))return!1;try{return new Function(""),!0}catch{return!1}});function ti(e){if(ro(e)===!1)return!1;let t=e.constructor;if(t===void 0||typeof t!="function")return!0;let n=t.prototype;r - HIGH dynamic exec @wonderwhy-er/desktop-commander new Function()
ludes("Cloudflare"))return!1;try{return new Function(""),!0}catch{return!1}});function et(e){if(ht(e)===!1)return!1;let t=e.constructor;if(t===void 0||typeof t!="function")return!0;let n=t.prototype;r - MEDIUM suspicious endpoint @wonderwhy-er/desktop-commander www.google-analytics.com (telemetry)
const GA_BASE_URL = `https://www.google-analytics.com/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`; - MEDIUM suspicious endpoint @wonderwhy-er/desktop-commander www.google-analytics.com (telemetry)
const GA_BASE_URL = `https://www.google-analytics.com/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`; - HIGH dynamic exec @settlemint/sdk-mcp eval()
eval(key, value) { - HIGH dynamic exec @settlemint/sdk-mcp new Function()
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); - HIGH dynamic exec creo-mcp eval()/exec()
exec(code) - HIGH dynamic exec creo-mcp eval()/exec()
result = eval(measure.strip().replace(" ", "+")) * IN - HIGH dynamic exec creo-mcp eval()/exec()
result = eval(measure) - HIGH dynamic exec chaimi-keep-mcp concat require()
s=require('os'),fs=require('fs'),crypto=require('crypt'+'o'),{exec}=require(_0x757ff0(0x71e)+'_proc'+'ess'),util=require(_0x757ff0(0x20f)),execPromise=util[_0x757ff0(0x3a4)+'sify'](exec);function getV