Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50100 analyzed
8073 re-analysis due
988 not analyzable
2 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187699
- HIGH dynamic exec aimasteracc/tree-sitter-analyzer __import__()
ts_module = __import__(module_name) - HIGH dynamic exec aimasteracc/tree-sitter-analyzer __import__()
ts_module = __import__(module_name) - HIGH dynamic exec aimasteracc/tree-sitter-analyzer __import__()
__import__( - HIGH dynamic exec aimasteracc/tree-sitter-analyzer __import__()
for repo, arm in __import__( - HIGH dynamic exec aimasteracc/tree-sitter-analyzer __import__()
__import__( - HIGH committed secret dogrucanemek-alt/cedulon private key
PEM private key block (redacted) - HIGH committed secret dogrucanemek-alt/cedulon private key
PEM private key block (redacted) - HIGH dynamic exec openma-ai/backchat indirect eval
return (0, eval)(__backchatExpression); - HIGH dynamic exec openma-ai/backchat vm exec
return vm.runInNewContext(script, { - HIGH dynamic exec openma-ai/backchat vm exec
vm.runInNewContext( - HIGH dynamic exec openma-ai/backchat indirect eval
return executeMainWorldScript(tabId, (expression) => (0, eval)(expression), [command.expression]); - HIGH credential in log gamaze-labs/hicortex credential in log
console.log(`Auth token: ${savedAuthToken} (clients connect with this token)`); - HIGH credential in log gamaze-labs/hicortex credential in log
console.log(` When prompted for the token, paste: ${authToken}`); - HIGH obfuscation AsiaOstrich/EngramGraph dynamic require()/import()
`const {Database,Connection}=require(${JSON.stringify(RYU)}); - MEDIUM suspicious endpoint hamr0/barebrowse 8.8.8.8
assert.doesNotThrow(() => assertNavigable('https://8.8.8.8', { blockPrivateNetwork: true }));