Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50066 analyzed
8097 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6178
- dynamic exec 11834
- obfuscation 3579
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187628
- MEDIUM suspicious endpoint Auriti-Labs/geo-optimizer-skill 169.254.169.254 (cloud metadata)
result = runner.invoke(cli, ["fix", "--url", "http://169.254.169.254/metadata"]) - MEDIUM suspicious endpoint Auriti-Labs/geo-optimizer-skill 169.254.169.254 (cloud metadata)
ok, err = validate_public_url("http://169.254.169.254/metadata") - MEDIUM suspicious endpoint Auriti-Labs/geo-optimizer-skill analytics.google.com (telemetry)
"https://analytics.google.com https://*.analytics.google.com " - MEDIUM suspicious endpoint Auriti-Labs/geo-optimizer-skill www.google-analytics.com (telemetry)
"img-src 'self' data: https://www.google-analytics.com https://www.googletagmanager.com " - HIGH committed secret spectrayan/spector Slack token
xoxb-s…(23 chars, redacted) - HIGH committed secret spectrayan/spector Slack token
xoxb-i…(23 chars, redacted) - HIGH committed secret tejasghutukade/stageflow OpenAI key
sk-aaa…(23 chars, redacted) - HIGH obfuscation onetapstudiogames/1f3d9 dynamic require()/import()
const { windowSnapshot } = await import(${JSON.stringify(windowUrl)}) - HIGH dynamic exec onetapstudiogames/1f3d9 new Function()
assert.doesNotThrow(() => new Function(WINDOW_JS)) - HIGH dynamic exec onetapstudiogames/1f3d9 new Function()
const relativeGap = new Function('return ' + source[0])() as - HIGH dynamic exec onetapstudiogames/1f3d9 new Function()
const run = new Function( - HIGH dynamic exec onetapstudiogames/1f3d9 new Function()
assert.doesNotThrow(() => new Function(WINDOW_JS)) - HIGH dynamic exec onetapstudiogames/1f3d9 new Function()
const isQuietPlace = new Function('return ' + source[0])() as (place: unknown) => boolean - HIGH dynamic exec onetapstudiogames/1f3d9 new Function()
return new Function(parts.join('\n\n'))() as ( - HIGH dynamic exec onetapstudiogames/1f3d9 new Function()
assert.doesNotThrow(() => new Function(CREDIT_BUY_JS))