Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51192 analyzed
7507 re-analysis due
995 not analyzable
1 not yet analyzed
4848 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12007
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190152
- HIGH dynamic exec brambleworks/SiteCMD-app new Function()
new Function("window", "performance", "PerformanceObserver", script)( - HIGH dynamic exec brambleworks/SiteCMD-app new Function()
new Function("window", "performance", "PerformanceObserver", OBSERVER)( - HIGH committed secret AbdulWahabRaza123/toolyour-mcp Stripe live key
sk_liv…(28 chars, redacted) - HIGH committed secret AbdulWahabRaza123/toolyour-mcp Stripe live key
sk_liv…(28 chars, redacted) - HIGH committed secret AbdulWahabRaza123/toolyour-mcp Stripe live key
sk_liv…(28 chars, redacted) - HIGH committed secret AbdulWahabRaza123/toolyour-mcp Stripe live key
sk_liv…(28 chars, redacted) - HIGH committed secret AbdulWahabRaza123/toolyour-mcp Stripe live key
sk_liv…(28 chars, redacted) - MEDIUM suspicious endpoint bharat3645/The-Ideal-Harness 93.184.216.34
const result = await checkUrlSafety(new URL('http://93.184.216.34/')); - MEDIUM suspicious endpoint bharat3645/The-Ideal-Harness 8.8.8.8
const result = await checkUrlSafety(new URL('http://8.8.8.8/'), failIfCalled); - MEDIUM suspicious endpoint bharat3645/The-Ideal-Harness 169.254.169.254 (cloud metadata)
const result = await checkUrlSafety(new URL('http://169.254.169.254/latest/meta-data/'), failIfCalled); - MEDIUM suspicious endpoint bharat3645/The-Ideal-Harness 169.254.169.254 (cloud metadata)
const result = await fetchPage('http://169.254.169.254/latest/meta-data/', { policyTiers: [[ALLOW_ALL]] }); - HIGH committed secret bharat3645/The-Ideal-Harness GitHub token
ghp_01…(41 chars, redacted) - HIGH committed secret bharat3645/The-Ideal-Harness Anthropic key
sk-ant…(43 chars, redacted) - HIGH committed secret bharat3645/The-Ideal-Harness Anthropic key
sk-ant…(37 chars, redacted) - HIGH dynamic exec bharat3645/The-Ideal-Harness eval()
message: eval() executes arbitrary code from a runtime value.