Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50100 analyzed
8073 re-analysis due
988 not analyzable
2 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187699
- MEDIUM suspicious endpoint MustafaKemal0146/fetih t.me
"url": "https://t.me/BotFather", - HIGH dynamic exec MustafaKemal0146/fetih unsafe yaml.load()
return yaml.load(value, Loader=loader) - MEDIUM over-broad oauth scope MustafaKemal0146/fetih https://www.googleapis.com/auth/cloud-platform
"https://www.googleapis.com/auth/cloud-platform " - HIGH hidden prompt MustafaKemal0146/fetih skill: skill-exfil
secret→sink: | Add comment | `gh pr comment N --body "..."` | `curl -X POST .../issues/N/comments -d '{"body":"..."}'` | - HIGH dynamic exec asuramaya/osiris eval()/exec()
exec(show.stdout, ns) # noqa: S102 — trusted, test-authored fixture content only - MEDIUM suspicious endpoint asuramaya/osiris t.me
assert items[0]["url"] == "https://t.me/s/dprk_news" # template rendered - HIGH dynamic exec asuramaya/osiris __import__ sink
env={**__import__("os").environ, "GIT_AUTHOR_DATE": when, "GIT_COMMITTER_DATE": when}, - MEDIUM suspicious endpoint asuramaya/osiris t.me
assert classify("https://t.me/dprk_news") == "URL" - MEDIUM suspicious endpoint asuramaya/osiris t.me
hid = await suspend(actions, ledger, manifest, chan, cid, url="https://t.me/s/dprk_news", - MEDIUM suspicious endpoint Uri6407/claudegram t.me
assert normalize_chat("https://t.me/joinchat/abc") == "https://t.me/joinchat/abc" - HIGH dynamic exec Uri6407/claudegram __import__()
mod = __import__(f"server.tools.{path}", fromlist=["get_client"]) - MEDIUM suspicious endpoint eduair94/cambio-uruguay 104.234.204.107
const API_BASE_URL = process.argv.find((a) => a.startsWith("--api-url="))?.split("=")[1] || "http://104.234.204.107:3528"; - HIGH committed secret eduair94/cambio-uruguay Google API key
AIzaSy…(39 chars, redacted) - HIGH committed secret eduair94/cambio-uruguay Google API key
AIzaSy…(39 chars, redacted) - HIGH committed secret eduair94/cambio-uruguay Google API key
AIzaSy…(39 chars, redacted)