Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50100 analyzed
8073 re-analysis due
988 not analyzable
2 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187699
- HIGH dynamic exec empir3hq/empir3-bridge vm exec
const update=vm.runInNewContext(javascript+';launchProviderUpdate;',{ - HIGH dynamic exec empir3hq/empir3-bridge vm exec
vm.runInNewContext(script,{ - HIGH dynamic exec empir3hq/empir3-bridge vm exec
const observation=vm.runInNewContext(expression,{location:{href:'https://fixture.invalid/'},document:{title:'Fixture',body:{innerText:'x'.repeat(300)},querySelectorAll:()=>Array.from({length:10},()=>( - HIGH dynamic exec empir3hq/empir3-bridge vm exec
vm.runInNewContext(code, { $: get, postJson: () => { calls++; return new Promise(resolve => { reply = resolve; }); }, - HIGH dynamic exec empir3hq/empir3-bridge vm exec
Ready:async()=>{},cdpEvaluate:async js=>vm.runInNewContext(js,page),sendJSON:(_res,value)=>{result=value}});vm.runInContext(code,context);await context.request();return JSON.parse(JSON.stringify(resul - HIGH dynamic exec empir3hq/empir3-bridge vm exec
const show=vm.runInNewContext(javascript+';showChromeWindow;',{ - HIGH dynamic exec empir3hq/empir3-bridge vm exec
return vm.runInNewContext(ts.transpileModule(node.getText(tree),{compilerOptions:{target:ts.ScriptTarget.ES2022}}).outputText+`;${name};`,context); - HIGH dynamic exec empir3hq/empir3-bridge vm exec
const raw = vm.runInNewContext(expression, { - HIGH dynamic exec empir3hq/empir3-bridge vm exec
return JSON.parse(JSON.stringify(vm.runInNewContext(browserObservationExpression({browserTextCharacters:1000,browserElements:20,browserNameCharacters:100}),{ - HIGH dynamic exec empir3hq/empir3-bridge vm exec
return JSON.parse(JSON.stringify(vm.runInNewContext(browserObservationExpression({ browserTextCharacters: 5000, browserElements: 300, browserNameCharacters: 100, ...limits }), { - MEDIUM suspicious endpoint empir3hq/empir3-bridge 169.254.169.254 (cloud metadata)
'http://169.254.169.254/latest/meta-data/', - HIGH dynamic exec empir3hq/empir3-bridge vm exec
const run=input=>JSON.parse(JSON.stringify(vm.runInNewContext(browserControlExpression({locator:{selector:'#disclosure'},...input}),{ - HIGH dynamic exec empir3hq/empir3-bridge vm exec
n scroll},run:async()=>JSON.parse(await vm.runInNewContext(browserActionPointExpression('#test','test',false,'','tab-1'),{document,innerWidth:800,innerHeight:600,getComputedStyle:n=>n.style,setTimeout - HIGH dynamic exec empir3hq/empir3-bridge vm exec
const preamble=vm.runInNewContext(ts.transpileModule(declaration.getText(tree),{compilerOptions:{target:ts.ScriptTarget.ES2022}}).outputText+';desktopPreamble;'); - HIGH dynamic exec empir3hq/empir3-bridge new Function()
new Function(match[1]);