Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50066 analyzed
8097 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6178
- dynamic exec 11834
- obfuscation 3579
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187628
- HIGH obfuscation Apra-Labs/apra-fleet dynamic require()/import()
const installMod = await import(`../../../dist/cli/install.js?fyc3=${cacheBust}`); - HIGH obfuscation Apra-Labs/apra-fleet dynamic require()/import()
const wired = await import(`../fleet-sprint/contracts.mjs?packaging-test-empty=${Date.now()}-${Math.random()}`); - HIGH obfuscation Apra-Labs/apra-fleet dynamic require()/import()
return await import(`../fleet-sprint/contracts.mjs?observability-test=${Date.now()}-${Math.random()}`); - HIGH obfuscation Apra-Labs/apra-fleet dynamic require()/import()
wired = await import(`../fleet-sprint/contracts.mjs?wired-test=${Date.now()}`); - HIGH dynamic exec Apra-Labs/apra-fleet new Function()
const fn = new Function('document', 'fetch', 'setTimeout', `${script}\nreturn { stopWorkflow, closeStopModal, confirmStopWorkflow, showStopToast };`); - HIGH dynamic exec Apra-Labs/apra-fleet new Function()
const { DEFAULT_CALIBRATION, truncateStreakToCeiling } = new Function( - HIGH dynamic exec Apra-Labs/apra-fleet new Function()
const fn = new Function(`${m[0]}; return sprintStateFileFor;`)(); - HIGH dynamic exec Apra-Labs/apra-fleet new Function()
} = new Function(`${match[1]}; return { computeSprintAnalysis, computeSprintQuote, DEFAULT_CALIBRATION, MODEL_SONNET };`)(); - HIGH dynamic exec Apra-Labs/apra-fleet new Function()
} = new Function(`${match[1]}; return { buildExecutionSummary, buildSprintSummary };`)(); - HIGH dynamic exec Apra-Labs/apra-fleet new Function()
} = new Function(`${match[1]}; return { MODEL_OPUS, MODEL_SONNET, MODEL_HAIKU, DEFAULT_CALIBRATION, reviewerModelFor, computeSprintQuote, computeSprintAnalysis, computeUpdatedCalibration, accumulateBu - HIGH dynamic exec Apra-Labs/apra-fleet new Function()
} = new Function(`${match[1]}; return { MODEL_SONNET, MODEL_HAIKU, parseBlockers, parseReadyStreaks, parseCycleState, collectSubtreeIds };`)(); - HIGH dynamic exec Apra-Labs/apra-fleet new Function()
} = new Function( - HIGH dynamic exec Apra-Labs/apra-fleet new Function()
new Function(`${match[1]}; return { computeSprintQuote, DEFAULT_CALIBRATION };`)(); - HIGH dynamic exec Apra-Labs/apra-fleet new Function()
return new Function(`${block}\n return { ${names.join(', ')} };`)(); - HIGH dynamic exec Apra-Labs/apra-fleet new Function()
const shellMaxTurns = new Function('cmds', shellMaxTurnsMatch[1]);