Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51192 analyzed
7507 re-analysis due
995 not analyzable
1 not yet analyzed
4848 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12007
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190152
- HIGH dynamic exec nodalityjs/nodality new Function()
const back = new Function(`return (${src});`)(); - HIGH obfuscation nodalityjs/nodality dynamic require()/import()
const mod = await import(${JSON.stringify(LIB)}); - HIGH obfuscation giauphan/codeatlas-platform dynamic require()/import()
const mod = await import(`../../../src/utils/logger.js?v=${randomVersion}`); - HIGH obfuscation giauphan/codeatlas-platform dynamic require()/import()
connectionModule = await import(`../../../src/database/connection.ts${cacheBuster}`); - MEDIUM over-broad oauth scope giauphan/codeatlas-platform https://www.googleapis.com/auth/cloud-platform
"https://www.googleapis.com/auth/cloud-platform", - HIGH dynamic exec BucherFeng/task-router eval()/exec()
exec(compile(code, "plugin-launcher", "exec"), {}) - HIGH dynamic exec ThinkInAIXYZ/deepchat constructor escape
return value.constructor.constructor('return process')() - MEDIUM suspicious endpoint ThinkInAIXYZ/deepchat 8.8.8.8
const sourceUrl = 'https://8.8.8.8/generated.png' - HIGH committed secret ThinkInAIXYZ/deepchat OpenAI key
sk-pro…(28 chars, redacted) - HIGH committed secret ThinkInAIXYZ/deepchat OpenAI key
sk-pro…(28 chars, redacted) - MEDIUM suspicious endpoint ThinkInAIXYZ/deepchat api.telegram.org
this.baseUrl = `https://api.telegram.org/bot${botToken}` - HIGH credential in log rexleimo/aios credential in log
console.log(password); - HIGH obfuscation rexleimo/aios dynamic require()/import()
require(`prismjs/components/prism-${id}`); - HIGH committed secret openchoreo/openchoreo private key
PEM private key block (redacted) - HIGH committed secret openchoreo/openchoreo private key
PEM private key block (redacted)