Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50100 analyzed
8073 re-analysis due
988 not analyzable
2 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187701
- HIGH committed secret memtomem/memtomem Anthropic key
sk-ant…(47 chars, redacted) - HIGH dynamic exec memtomem/memtomem __import__ sink
original = dict(__import__("os").environ) - MEDIUM suspicious endpoint ddmd72/alekbot-core api.telegram.org
def _file_info(path="https://api.telegram.org/file/bot123/voice/file_1.oga"): - MEDIUM suspicious endpoint ddmd72/alekbot-core api.telegram.org
mock_file_info1.file_path = "https://api.telegram.org/file/bot123/photos/file_1.jpg" - MEDIUM suspicious endpoint ddmd72/alekbot-core api.telegram.org
url = "https://api.telegram.org/file/bot123/photo.jpg" - MEDIUM over-broad oauth scope ddmd72/alekbot-core https://mail.google.com/
f"https://mail.google.com/mail/u/0/#all/{{email_id}}\n" - MEDIUM over-broad oauth scope ddmd72/alekbot-core https://www.googleapis.com/auth/cloud-platform
_SCOPES = ["https://www.googleapis.com/auth/cloud-platform"] - HIGH dynamic exec nimbuscloud-ai/suss vm exec
vm.runInNewContext( - HIGH dynamic exec nimbuscloud-ai/suss vm exec
vm.runInNewContext( - HIGH dynamic exec nimbuscloud-ai/suss vm exec
const collectGarbage = vm.runInNewContext("gc"); - HIGH dynamic exec nimbuscloud-ai/suss vm exec
vm.runInNewContext( - HIGH committed secret karvidsson/kbots Anthropic key
sk-ant…(37 chars, redacted) - MEDIUM suspicious endpoint karvidsson/kbots eu.posthog.com (telemetry)
"host": "https://eu.posthog.com", - MEDIUM suspicious endpoint karvidsson/kbots discord.com
WEBHOOK = "https://discord.com/api/webhooks/123/synthetic-webhook-token" - HIGH dynamic exec karvidsson/kbots eval()/exec()
exec(compile(source, f"<{name}>", "exec"), mod.__dict__)