Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50020 analyzed
8131 re-analysis due
988 not analyzable
1 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6177
- dynamic exec 11826
- obfuscation 3575
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2548
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187620
- HIGH committed secret rootazero/IntelHub private key
PEM private key block (redacted) - HIGH dynamic exec achiya-automation/safari-mcp new Function()
const fn = new Function("document", "window", "getComputedStyle", "CSS", "return " + script); - HIGH dynamic exec achiya-automation/safari-mcp vm exec
vm.runInNewContext( - HIGH dynamic exec achiya-automation/safari-mcp new Function()
const fn = new Function(`${source}; return { _aliasReceipt, _receiptToken };`); - HIGH dynamic exec achiya-automation/safari-mcp new Function()
assert.doesNotThrow(() => { fn = new Function(built); }, `must parse as valid JS: ${JSON.stringify(payload)}`); - HIGH dynamic exec achiya-automation/safari-mcp new Function()
const resolveReceipt = new Function( - HIGH dynamic exec achiya-automation/safari-mcp indirect eval
return (0, eval)(wrapped); // eslint-disable-line no-eval - HIGH dynamic exec achiya-automation/safari-mcp indirect eval
var direct = (0, eval)(String(d.source)); - HIGH dynamic exec achiya-automation/safari-mcp indirect eval
out = (0, eval)(String(payload.source || "")); - HIGH dynamic exec achiya-automation/safari-mcp indirect eval
const result = await (0, eval)(script); - MEDIUM suspicious endpoint Thysrael/Horizon 169.254.169.254 (cloud metadata)
"http://169.254.169.254/", - MEDIUM suspicious endpoint Thysrael/Horizon t.me
"https://t.me/s", - MEDIUM suspicious endpoint Sunrise-Labs-Dot-AI/ghostie us.i.posthog.com (telemetry)
var POSTHOG_HOST = "https://us.i.posthog.com"; - HIGH obfuscation geml-spec/geml dynamic require()/import()
await import(`${CONTENT}?case=${caseN++}`); - HIGH obfuscation geml-spec/geml dynamic require()/import()
await import(`../src/content.js?case=${caseN++}`);