Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50100 analyzed
8073 re-analysis due
988 not analyzable
2 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187699
- HIGH obfuscation Hmbown/codewhale-cu-plugin dynamic require()/import()
await import(${JSON.stringify(pathToFileURL(script).href)}); - HIGH dynamic exec TitaniumAgent/Titanium-Agent new Function()
const ZSParse = new Function(fs.readFileSync(__dirname + "/core/parser.js", "utf8") + "; return ZSParse;")(); - HIGH dynamic exec TitaniumAgent/Titanium-Agent new Function()
const P = new Function( - HIGH dynamic exec kim1st0913/SAPD_Wiki __import__ sink
original_popen = __import__("subprocess").Popen - MEDIUM suspicious endpoint Churma16/wallet-mcp-budgetbakers-bot api.telegram.org
throw new Error(`connect ETIMEDOUT https://api.telegram.org/file/bot${dummyToken}/photos/fail.jpg`); - MEDIUM suspicious endpoint Churma16/wallet-mcp-budgetbakers-bot api.telegram.org
input: 'Request failed for https://api.telegram.org/file/bot1234567890:ABCdefGHIjklMNOpqrsTUVwxyz123456789/photos/file_0.jpg', - MEDIUM suspicious endpoint Churma16/wallet-mcp-budgetbakers-bot api.telegram.org
const downloadError = new Error(`Request failed: https://api.telegram.org/file/bot${sensitiveToken}/photos/pic.jpg timed out`); - MEDIUM suspicious endpoint Churma16/wallet-mcp-budgetbakers-bot t.me
'https://t.me/BotFather', - MEDIUM suspicious endpoint Churma16/wallet-mcp-budgetbakers-bot api.telegram.org
const downloadFileUrl = `https://api.telegram.org/file/bot${this.botToken}/${fileMetadata.file_path}`; - MEDIUM suspicious endpoint Churma16/wallet-mcp-budgetbakers-bot api.telegram.org
baseURL: 'https://api.telegram.org', - HIGH dynamic exec mcp-behaviour-guard unsafe yaml.load()
raw = yaml.load( - HIGH dynamic exec krillinai/Clawee new Function()
new Function("window", "document", "localStorage", themeInitScript())( - HIGH dynamic exec drexthealpha/Knos __import__ sink
env={**__import__("os").environ, "KNOS_HOME": str(knos_home)}, - HIGH committed secret enchanter-ai/hydra private key
PEM private key block (redacted) - HIGH committed secret enchanter-ai/hydra Anthropic key
sk-ant…(98 chars, redacted)