Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50100 analyzed
8073 re-analysis due
988 not analyzable
2 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187701
- MEDIUM suspicious endpoint tourhabk-ui/pos t.me
<a href={`https://t.me/share/url?url=${encodeURIComponent(withReferral(shareUrl, myReferralCode))}&text=${encodeURIComponent(`${(recommendation as { title?: string } | null)?.title ?? 'Маршрут'} — ${d - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
<a href="https://t.me/KuzmichKam_bot" style={{ color: 'var(--ocean)' }}> - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
out.push({ label: 'Написать в Telegram', href: `https://t.me/${tgc}`, icon: 'telegram' }); - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
Кузьмич — AI-консьерж Ведара (доступен на сайте, в Telegram [@kuzmichai_bot](https://t.me/kuzmichai_bot) и в MAX; единый контекст между каналами). - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
"https://t.me/kamchatourhub", - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
href={`https://t.me/${clientTg.replace('@', '')}?text=${encodeURIComponent(`Ваша подборка туров: ${created.url}`)}`} - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
href="https://t.me/kuzmichai_bot" - MEDIUM suspicious endpoint tourhabk-ui/pos api.telegram.org
const res = await fetch(`https://api.telegram.org/bot${token}/${method}`, { - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
'https://t.me/kamchatourhub', - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
<a href={`https://t.me/${booking.operator_telegram.replace('@', '')}`} - MEDIUM suspicious endpoint tourhabk-ui/pos api.telegram.org
const res = await fetch(`${process.env.TELEGRAM_API_BASE||'https://api.telegram.org'}/bot${token}/sendPhoto`, { - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
source_url: 'https://t.me/kuzmichai_bot', - MEDIUM suspicious endpoint tourhabk-ui/pos api.telegram.org
`${process.env.TELEGRAM_API_BASE||'https://api.telegram.org'}/bot${botToken}/setWebhook`, - MEDIUM suspicious endpoint tourhabk-ui/pos api.telegram.org
const res = await fetch(`${process.env.TELEGRAM_API_BASE||'https://api.telegram.org'}/bot${token}/setWebhook`, { - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
`\n\n<a href="https://t.me/${botUsername}">Написать Кузьмичу →</a>`;