Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51314 analyzed
7403 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- MEDIUM suspicious endpoint Mintplex-Labs/anything-llm t.me
to={`https://t.me/${config.bot_username}`} - MEDIUM suspicious endpoint Mintplex-Labs/anything-llm 123.123.123.123
expect(validateURL("123.123.123.123")).toBe("https://123.123.123.123"); - HIGH dynamic exec youichi-uda/blender-mcp-pro eval()/exec()
exec(code, namespace) - MEDIUM suspicious endpoint react-native-ai-devtools us.i.posthog.com (telemetry)
const host = "https://us.i.posthog.com"; - MEDIUM suspicious endpoint infernoflow eu.i.posthog.com (telemetry)
ry.json"),h=f.join(d,"events.jsonl"),T="https://eu.i.posthog.com",k="phc_z6YX7x4zjkuFZigdXTBoFcPTWeGLFAN9NNKVZ5WHQrqk";function a(){try{return JSON.parse(s.readFileSync(w,"utf8"))}catch{return null}}f - HIGH dynamic exec butterbase-ai/butterbase-oss eval()
async eval(script: string, keys: string[], args: string[]): Promise<unknown> { - MEDIUM suspicious endpoint Kaelio/ktx-ai-data-agents-context us.i.posthog.com (telemetry)
host: 'https://us.i.posthog.com', - MEDIUM suspicious endpoint Kaelio/ktx-ai-data-agents-context us.i.posthog.com (telemetry)
const POSTHOG_HOST = 'https://us.i.posthog.com'; - MEDIUM suspicious endpoint @wonderwhy-er/desktop-commander www.google-analytics.com (telemetry)
const GA_OLD_URL = `https://www.google-analytics.com/mp/collect?measurement_id=${GA_OLD_ID}&api_secret=${GA_OLD_SECRET}`; - MEDIUM suspicious endpoint @wonderwhy-er/desktop-commander www.google-analytics.com (telemetry)
const GA_BASE_URL = `https://www.google-analytics.com/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`; - HIGH dynamic exec @wonderwhy-er/desktop-commander new Function()
ludes("Cloudflare"))return!1;try{return new Function(""),!0}catch{return!1}});function ti(e){if(ro(e)===!1)return!1;let t=e.constructor;if(t===void 0||typeof t!="function")return!0;let n=t.prototype;r - HIGH dynamic exec @wonderwhy-er/desktop-commander new Function()
ludes("Cloudflare"))return!1;try{return new Function(""),!0}catch{return!1}});function et(e){if(ht(e)===!1)return!1;let t=e.constructor;if(t===void 0||typeof t!="function")return!0;let n=t.prototype;r - MEDIUM suspicious endpoint @wonderwhy-er/desktop-commander www.google-analytics.com (telemetry)
const GA_BASE_URL = `https://www.google-analytics.com/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`; - MEDIUM suspicious endpoint @wonderwhy-er/desktop-commander www.google-analytics.com (telemetry)
const GA_BASE_URL = `https://www.google-analytics.com/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`; - HIGH dynamic exec @settlemint/sdk-mcp eval()
eval(key, value) {