Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50064 analyzed
8099 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6178
- dynamic exec 11834
- obfuscation 3579
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187628
- HIGH dynamic exec Apra-Labs/apra-fleet new Function()
const extractedBuildRunTitle = new Function(`${helpers}\nreturn buildRunTitle;`)(); - HIGH dynamic exec Apra-Labs/apra-fleet new Function()
const fn = new Function('phaseEl', 'phase', `${helpers}\n${renderBlock}`); - HIGH dynamic exec Apra-Labs/apra-fleet new Function()
const fn = new Function('EventSource', 'CustomEvent', 'document', 'poll', script); - HIGH dynamic exec Apra-Labs/apra-fleet new Function()
const fn = new Function('document', 'state', 'resumeWorkflow', 'pauseWorkflow', 'escapeHtml', extractPauseRenderBlock()); - HIGH dynamic exec Apra-Labs/apra-fleet new Function()
const fn = new Function('act', 'escapeHtml', `${body}\nreturn childrenHtml;`); - HIGH dynamic exec Apra-Labs/apra-fleet new Function()
const factory = new Function(` - HIGH dynamic exec Apra-Labs/apra-fleet new Function()
const factory = new Function(`${helpers}\nreturn { formatTime, formatUptime };`); - HIGH dynamic exec Apra-Labs/apra-fleet new Function()
const factory = new Function(` - HIGH dynamic exec Apra-Labs/apra-fleet new Function()
const factory = new Function(` - HIGH dynamic exec Apra-Labs/apra-fleet new Function()
const fn = new Function('document', 'window', 'event', 'location', script + '\n;return switchTab;'); - HIGH dynamic exec Apra-Labs/apra-fleet new Function()
const fn = new Function('document', 'fetch', 'EventSource', script); - HIGH obfuscation Apra-Labs/apra-fleet dynamic require()/import()
const { validateRoleInput } = await import(`../fleet-sprint/contracts.mjs?role-input-contract=${Date.now()}`); - HIGH obfuscation Apra-Labs/apra-fleet dynamic require()/import()
const before = await import(`${pathToFileURL(sandboxRunnerPath).href}?facade-sanity=${Date.now()}-${Math.random()}`); - HIGH obfuscation Apra-Labs/apra-fleet dynamic require()/import()
const before = await import(`${pathToFileURL(sandboxRunnerPath).href}?facade-sanity=${Date.now()}-${Math.random()}`); - HIGH obfuscation Apra-Labs/apra-fleet dynamic require()/import()
const installMod = await import(`${pathToFileURL(path.join(ROOT, 'dist/cli/install.js')).href}?installed-supervisor=${cacheBust}`);