Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51192 analyzed
7507 re-analysis due
995 not analyzable
1 not yet analyzed
4848 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12007
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190152
- HIGH obfuscation tigu77/tiguclaw dynamic require()/import()
const m = await import(${JSON.stringify(path.join(REPO, "src/core/plugins/manager.ts"))}); - HIGH obfuscation tigu77/tiguclaw dynamic require()/import()
const m = await import(${JSON.stringify(path.join(REPO, "src/core/plugins/manager.ts"))}); - HIGH obfuscation tigu77/tiguclaw dynamic require()/import()
const { loadPlugins } = await import(${JSON.stringify(path.join(REPO, "src/core/plugins/loader.ts"))}); - HIGH committed secret tigu77/tiguclaw GitHub token
ghp_16…(40 chars, redacted) - MEDIUM suspicious endpoint tigu77/tiguclaw api.telegram.org
`telegram send failed: request to https://api.telegram.org/bot${fake}/sendMessage failed`, - HIGH dynamic exec tigu77/tiguclaw new Function()
const make = new Function( - HIGH dynamic exec tigu77/tiguclaw new Function()
const make = new Function( - HIGH dynamic exec tigu77/tiguclaw eval()
const tgBytes = m === null ? NaN : Number(eval(m[1] as string)); - HIGH committed secret tigu77/tiguclaw Slack token
xoxb-2…(31 chars, redacted) - HIGH committed secret tigu77/tiguclaw GitHub token
ghp_16…(40 chars, redacted) - HIGH obfuscation tigu77/tiguclaw dynamic require()/import()
const m = await import(${JSON.stringify(path.join(REPO, "src/core/plugins/manager.ts"))}); - HIGH dynamic exec tigu77/tiguclaw new Function()
: (new Function("segText", "entryText", m[1]!) as ( - HIGH dynamic exec tigu77/tiguclaw new Function()
new Function("require", "exports", "Map", compiled)(createRequire(import.meta.url), exports, ObservedMap); - HIGH dynamic exec tigu77/tiguclaw new Function()
const engage = new Function( - HIGH dynamic exec tigu77/tiguclaw new Function()
const row = new Function(`${JS_I18N_STUB}${src}return versionStatusRow;`)() as (