Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50064 analyzed
8099 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6178
- dynamic exec 11834
- obfuscation 3579
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187628
- MEDIUM over-broad oauth scope ThreeMoonsLab/agents-shipgate delete_repo
"github": {"command": "gh", "tools": {"search": {}, "delete_repo": {}}} - HIGH dynamic exec ThreeMoonsLab/agents-shipgate eval()/exec()
exec(compile(_hook_script_text(), "generated-hook.py", "exec"), namespace) - HIGH dynamic exec ThreeMoonsLab/agents-shipgate eval()/exec()
exec(compile(code, str(script), "exec"), namespace) - HIGH dynamic exec ThreeMoonsLab/agents-shipgate pickle.loads()
pickle.loads(pickle.dumps(rendered)), - HIGH dynamic exec ThreeMoonsLab/agents-shipgate eval()/exec()
exec(compile(path.read_text(encoding="utf-8"), str(path), "exec"), namespace) - HIGH committed secret ThreeMoonsLab/agents-shipgate OpenAI key
sk-aaa…(27 chars, redacted) - HIGH committed secret ThreeMoonsLab/agents-shipgate OpenAI key
sk-pro…(29 chars, redacted) - HIGH committed secret ThreeMoonsLab/agents-shipgate OpenAI key
sk-pro…(30 chars, redacted) - HIGH dynamic exec ThreeMoonsLab/agents-shipgate __import__()
__import__(module_name) - HIGH dynamic exec ThreeMoonsLab/agents-shipgate unsafe yaml.load()
data = yaml.load(text) or {} - HIGH dynamic exec ThreeMoonsLab/agents-shipgate __import__()
return __import__(name) - HIGH obfuscation moeilijk/ai-assisted-speedruns dynamic require()/import()
const { default: plugin } = await import(`../plugin.mjs?port=${fake.port}`); - HIGH obfuscation moeilijk/ai-assisted-speedruns dynamic require()/import()
const { default: plugin } = await import(`../plugin.mjs?port=${fake.port}&bot=1`); - HIGH dynamic exec moeilijk/ai-assisted-speedruns new Function()
try { result = await new Function("sts", `return (async () => { ${step.code} })()`)(api); } catch (e) { result = { error: e.message }; } - HIGH committed secret MikkoParkkola/mcp-gateway Anthropic key
sk-ant…(45 chars, redacted)