Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50066 analyzed
8097 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6178
- dynamic exec 11834
- obfuscation 3579
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187628
- HIGH dynamic exec MadGapun/PBP __import__()
or list(__import__( - HIGH dynamic exec MadGapun/PBP __import__()
m = __import__(mod_name) - HIGH dynamic exec MadGapun/PBP eval()/exec()
version = eval(r.stdout.strip()) - HIGH committed secret Shipi18n/shipi18n Anthropic key
sk-ant…(39 chars, redacted) - HIGH committed secret Shipi18n/shipi18n Anthropic key
sk-ant…(39 chars, redacted) - HIGH dynamic exec SAIHM-Admin/saihm-mcp-server-pro new Function()
const buildClass = new Function(`return (${js})`)() as (probe: string) => string; - HIGH committed secret manishiitg/llm-provider-mcp Anthropic key
sk-ant…(62 chars, redacted) - MEDIUM suspicious endpoint AiFinPay/sdk 169.254.169.254 (cloud metadata)
headers: { location: "http://169.254.169.254/latest/meta-data/" }, - MEDIUM suspicious endpoint AiFinPay/sdk 169.254.169.254 (cloud metadata)
["cloud metadata", "http://169.254.169.254/api/auth/verify?token=x"], - HIGH committed secret r2cuerdame/WSLPad private key
PEM private key block (redacted) - MEDIUM suspicious endpoint pmgwee/BersamaAi-community discord.com
msg = news._post("https://discord.com/api/webhooks/123/abc", {}) - MEDIUM suspicious endpoint pmgwee/BersamaAi-community api.telegram.org
print("\n[telegram DRY-RUN] POST https://api.telegram.org/bot***/sendMessage " - MEDIUM suspicious endpoint Auriti-Labs/geo-optimizer-skill 169.254.169.254 (cloud metadata)
resp = client.post(_ENDPOINT, json={"base_url": "http://169.254.169.254/"}) - MEDIUM suspicious endpoint Auriti-Labs/geo-optimizer-skill 169.254.169.254 (cloud metadata)
ok, err = validate_public_url("http://169.254.169.254/latest/meta-data/") - MEDIUM suspicious endpoint Auriti-Labs/geo-optimizer-skill 169.254.169.254 (cloud metadata)
result = geo_audit("http://169.254.169.254/metadata")