Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51308 analyzed
7409 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH dynamic exec Zuehlke/labview-mcp eval()/exec()
exec(cmd, globals, locals) - HIGH dynamic exec Zuehlke/labview-mcp eval()/exec()
exec(cmd, globals, locals) - HIGH dynamic exec Zuehlke/labview-mcp eval()/exec()
return eval(code, globals=globals, locals=locals) - HIGH dynamic exec Zuehlke/labview-mcp eval()/exec()
exec(startup_code, namespace) - HIGH dynamic exec Zuehlke/labview-mcp eval()/exec()
exec(code, self.locals) - HIGH dynamic exec Zuehlke/labview-mcp __import__()
m = __import__(module, None, None, [klass]) - HIGH dynamic exec Zuehlke/labview-mcp __import__()
__import__(module) - HIGH dynamic exec Zuehlke/labview-mcp __import__()
__import__(f"{__spec__.parent}.{plugin}", globals(), locals(), []) - HIGH dynamic exec Zuehlke/labview-mcp eval()/exec()
exec(open(sys.argv[1], encoding="utf-8").read()) - HIGH dynamic exec Collinstudied660/mcp-hub eval()/exec()
if eval(expr, {"__builtins__": {}}, local): - HIGH dynamic exec nicoconic248/MCPSafari new Function()
const fn = new Function(`return (async () => { ${code} })()`); - HIGH suspicious skill script HKUDS/Vibe-Trading suspicious bundled script
feed: Market-data feed, ``iex`` (free) or ``sip`` (paid). - MEDIUM suspicious endpoint HKUDS/Vibe-Trading 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data", - MEDIUM suspicious endpoint HKUDS/Vibe-Trading 8.8.8.8
ok, _err = validate_url_target("http://8.8.8.8/x") - HIGH dynamic exec HKUDS/Vibe-Trading eval()/exec()
exec(code, namespace)