Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50100 analyzed
8073 re-analysis due
988 not analyzable
2 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187699
- MEDIUM suspicious endpoint StealHD/infohub-light 93.184.216.34
source_type, {"url": "http://93.184.216.34/feed.xml"} - MEDIUM suspicious endpoint StealHD/infohub-light 169.254.169.254 (cloud metadata)
"http://169.254.169.254/feed", - MEDIUM suspicious endpoint StealHD/infohub-light t.me
"telegram", {"channel": "https://t.me/durov"} - MEDIUM suspicious endpoint StealHD/infohub-light t.me
apify_telegram_item = social._parse_telegram({"Id": 2, "Date": NOW.isoformat(), "Url": "https://t.me/durov/2", "Body": "Apify TG message", "Channel_Handle": "durov"}, apify_telegram_sub, SINCE) - MEDIUM suspicious endpoint StealHD/infohub-light 1.1.1.1
assert str(second.url) == "https://1.1.1.1/next.xml" - MEDIUM suspicious endpoint StealHD/infohub-light 93.184.216.34
url="https://93.184.216.34/feed.xml", - MEDIUM suspicious endpoint StealHD/infohub-light discord.com
"https://discord.com/api/webhooks/" - MEDIUM suspicious endpoint StealHD/infohub-light api.telegram.org
f"https://api.telegram.org/bot{BOT_TOKEN}/sendMessage" - MEDIUM suspicious endpoint StealHD/infohub-light t.me
"https://t.me/example_channel", - HIGH dynamic exec StealHD/infohub-light eval()/exec()
exec(compile("raise RuntimeError('private-upstream-payload')", filename, "exec"), {}) - MEDIUM suspicious endpoint StealHD/infohub-light 93.184.216.34
assert calls[0][0] == "https://93.184.216.34/feed.xml" - MEDIUM suspicious endpoint StealHD/infohub-light t.me
"Url": "https://t.me/zaihuapd/99", - MEDIUM suspicious endpoint StealHD/infohub-light t.me
("name", "@name", "https://t.me/name"), ("名称", "@名称", "公开频道网址"), - MEDIUM suspicious endpoint StealHD/infohub-light t.me
html = _fetch_text(f"https://t.me/s/{channel}") - MEDIUM suspicious endpoint StealHD/infohub-light discord.com
"url_hint": "https://discord.com/api/webhooks/…/…",