Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50020 analyzed
8131 re-analysis due
988 not analyzable
1 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6177
- dynamic exec 11826
- obfuscation 3575
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2548
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187620
- HIGH obfuscation LE-VAI/designesy-org dynamic require()/import()
import(`../icons/${contract.file}?raw`).catch(async () => { - MEDIUM suspicious endpoint LE-VAI/designesy-org 104.20.23.154
assert.equal(isValidUrl('https://104.20.23.154'), true); - MEDIUM suspicious endpoint LE-VAI/designesy-org 8.8.8.8
assert.equal(isValidUrl('http://8.8.8.8'), true); - MEDIUM suspicious endpoint LE-VAI/designesy-org 1.1.1.1
assert.equal(isValidUrl('http://1.1.1.1'), true); - MEDIUM suspicious endpoint LE-VAI/designesy-org 169.254.169.254 (cloud metadata)
assert.equal(isValidUrl('http://169.254.169.254'), false); - MEDIUM suspicious endpoint LE-VAI/designesy-org 169.254.169.254 (cloud metadata)
res.writeHead(302, { location: 'http://169.254.169.254/latest/meta-data' }); - HIGH dynamic exec po4erk91/thread-keeper __import__ sink
__import__("os").environ.get("THREADKEEPER_SEARCH_PROXY_POLL_S", "0.5") - HIGH dynamic exec po4erk91/thread-keeper __import__()
mod = __import__(f"threadkeeper.{modname}", fromlist=[fn]) - HIGH dynamic exec po4erk91/thread-keeper __import__()
mod = __import__(f"threadkeeper.{mod_name}", fromlist=[fn_name]) - HIGH committed secret po4erk91/thread-keeper OpenAI key
sk-pro…(32 chars, redacted) - HIGH committed secret po4erk91/thread-keeper GitHub token
ghp_aa…(40 chars, redacted) - MEDIUM suspicious endpoint Wilkes-Liberty/drupal-mcp-connector 169.254.169.254 (cloud metadata)
expect(isSafeUrl("http://169.254.169.254/latest/meta-data").safe).toBe(false); - MEDIUM suspicious endpoint Wilkes-Liberty/drupal-mcp-connector 1.2.3.4
expect(isSafeUrl("http://1.2.3.4/x").safe).toBe(true); - HIGH committed secret zb-ss/servonaut Stripe live key
sk_liv…(34 chars, redacted) - MEDIUM suspicious endpoint zb-ss/servonaut 169.254.169.254 (cloud metadata)
endpoint_url="https://169.254.169.254",