Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51308 analyzed
7409 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH dynamic exec hertz-ai/HARTOS __import__()
mod = __import__(modname, fromlist=[attr]) - HIGH dynamic exec hertz-ai/HARTOS eval()/exec()
exec(compile(body, '<helper>', 'exec'), ns) - HIGH dynamic exec hertz-ai/HARTOS eval()/exec()
exec(compile(fn_src, '<isolated:_chat_reply>', 'exec'), ns) - HIGH dynamic exec hertz-ai/HARTOS eval()/exec()
exec(compile(fn_src, f'<isolated:{name}>', 'exec'), ns) - HIGH dynamic exec hertz-ai/HARTOS __import__ sink
'os': __import__('os'), - MEDIUM suspicious endpoint hertz-ai/HARTOS 169.254.169.254 (cloud metadata)
@pytest.mark.parametrize('url', ['http://169.254.169.254/latest/meta-data/', - HIGH committed secret hertz-ai/HARTOS OpenAI key
sk-pro…(32 chars, redacted) - HIGH dynamic exec hertz-ai/HARTOS eval()/exec()
exec(compile(ast.Module(body=nodes, type_ignores=[]), _SRC_PATH, 'exec'), ns) - HIGH dynamic exec hertz-ai/HARTOS __import__ sink
@patch('subprocess.run', side_effect=__import__('subprocess').TimeoutExpired('cmd', 300)) - HIGH committed secret hertz-ai/HARTOS Anthropic key
sk-ant…(55 chars, redacted) - HIGH committed secret hertz-ai/HARTOS Google API key
AIzaSy…(39 chars, redacted) - HIGH dynamic exec hertz-ai/HARTOS __import__()
__import__(module_name) - HIGH dynamic exec hertz-ai/HARTOS __import__()
__import__(module_name) - HIGH dynamic exec hertz-ai/HARTOS __import__()
mod = __import__(f'integrations.channels.{name}_adapter', fromlist=['_']) - HIGH dynamic exec hertz-ai/HARTOS __import__()
__import__(module)