Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51308 analyzed
7409 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH committed secret garfiec/Librechat-Mobile GitHub token
gho_16…(40 chars, redacted) - HIGH dynamic exec fioenix/fn-ignis __import__()
__import__(module) - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
candidates: [ok({ kind: 'telegram', url: 'https://t.me/+ll3pbl442dNkZmYy' })], - MEDIUM suspicious endpoint tourhabk-ui/pos 169.254.169.254 (cloud metadata)
expect(isAuditableUrl('http://169.254.169.254/latest/meta-data/')).toBe(false); - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
<a class="tgme_widget_message_date" href="https://t.me/ru_rst/1234"><time datetime="2026-09-03T10:00:00+00:00">10:00</time></a> - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
<a class="tgme_widget_message_date" href="https://t.me/vibecoding_tg/100"><time></time></a> - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
'https://t.me/s/mchs_official', - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
{ title: 'Землетрясение ML 5.2 — восточнее Петропавловска', source_url: 'https://t.me/kbgs/123' }, - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
key: 'k', url: 'https://t.me/s/k', direct_status: null, relay, - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
expect(urls).toContain('https://t.me/s/minec_tourism'); - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
const c = extractContacts('Пишите @kamrafting или https://t.me/kamchatka_raft , канал t.me/s/kamchatka_raft'); - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
telegram_channel: 'https://t.me/+GCy5EVOotCE1NDMy', - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
<a class="tgme_widget_message_date" href="https://t.me/minec_tourism/101"><time datetime="${new Date().toISOString()}"></time></a>`; - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
classifyMchsItem('mchs/w', title, text, '2026-08-10T10:00:00Z', 'https://t.me/mchs41', 'tg_mchs'); - MEDIUM suspicious endpoint tourhabk-ui/pos t.me
expect(classifyMchsItem('x', '', l, '2026-09-05T00:00:00Z', 'https://t.me/x'), l).toBeNull();