Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50064 analyzed
8099 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6178
- dynamic exec 11834
- obfuscation 3579
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187628
- HIGH dynamic exec simonlin1212/Vibe-Research new Function()
const isUsable = new Function("c", `const isCli=(p)=>p.startsWith("cli-");${fn[1]!.replace(/Boolean\(/g, "Boolean(")}`) as (c: unknown) => boolean; - HIGH dynamic exec simonlin1212/Vibe-Research vm exec
const run = vm.runInNewContext(callback("Research", "cancel"), { - HIGH dynamic exec simonlin1212/Vibe-Research vm exec
const load = vm.runInNewContext(compile("loadIndices"), { - HIGH dynamic exec simonlin1212/Vibe-Research vm exec
const [message, session] = vm.runInNewContext(`${generators[0]}\n[id(), session()]`, { crypto: {} }) as string[]; - HIGH dynamic exec cognigy-vibe-mcp eval()/exec()
exec(compile(source, str(output_path), "exec"), namespace) - MEDIUM over-broad oauth scope Kevin-Liu-01/Jarhead https://mail.google.com/
assert.ok(presenceGated(undefined, "https://mail.google.com/mail/u/0/#inbox")); - MEDIUM suspicious endpoint Kevin-Liu-01/Jarhead 169.254.169.254 (cloud metadata)
assert.equal(v("http://169.254.169.254/latest/meta-data/", "read https://example.com"), "refuse", "link-local is private"); - MEDIUM over-broad oauth scope Kevin-Liu-01/Jarhead https://mail.google.com/
gmail: "https://mail.google.com/", - HIGH dynamic exec fredporter/uCore __import__()
__import__(module) - HIGH dynamic exec fredporter/uCore __import__ sink
pids = [p for p in pids if p != __import__("os").getpid()] - MEDIUM over-broad oauth scope Canonry/canonry https://mail.google.com/
expect(shouldForward(request('https://example.com/', 'https://mail.google.com/'))).toBe(false) - HIGH dynamic exec Canonry/canonry new Function()
const exposePredicate = new Function( - MEDIUM suspicious endpoint Canonry/canonry 169.254.169.254 (cloud metadata)
await expect(() => fetchAndParseSitemap('http://169.254.169.254/sitemap.xml')).rejects.toThrow(/rejected/) - HIGH credential in log Canonry/canonry credential in log
log.info('smoke.completed', { runId: 'fixture-run', apiKey: 'secret-never-exposed', query: 'private-query' }) - MEDIUM suspicious endpoint Canonry/canonry 1.1.1.1
'https://1.1.1.1/canonry-webhook',