Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51308 analyzed
7409 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH committed secret f1shyondrugs/metis-ai Google OAuth client secret
GOCSPX…(35 chars, redacted) - HIGH dynamic exec f1shyondrugs/metis-ai new Function()
const compiled = new Function("scope", `"use strict"; return (${mapped});`) as (scope: Record<string, number>) => unknown; - MEDIUM suspicious endpoint anthillnet/sinain-hud api.telegram.org
fetch(`https://api.telegram.org/bot${token}/sendMessage`, { - MEDIUM suspicious endpoint anthillnet/sinain-hud api.telegram.org
fetch(`https://api.telegram.org/bot${token}/sendMessage`, { - HIGH committed secret Azure/data-api-builder OpenAI key
sk-pub…(30 chars, redacted) - HIGH dynamic exec mbeps/excel-mcp eval()/exec()
return float(eval(code, {"__builtins__": {}}, namespace)) # noqa: S307 - HIGH dynamic exec mbeps/excel-mcp eval()/exec()
return float(eval(code, {"__builtins__": {}}, namespace)) - HIGH dynamic exec mbeps/excel-mcp eval()/exec()
exec(code, {"__builtins__": _SAFE_BUILTINS}, namespace) # noqa: S102 - HIGH dynamic exec mbeps/excel-mcp __import__ sink
if __import__("os").environ.get("MCP_SERVER_DISABLE_TOOL_REGISTRATION") == "1": - HIGH dynamic exec omnislash157/graphyos __import__ sink
env = {**__import__("os").environ, "PYTHONPATH": str(Path(cli.__file__).parents[1])} - HIGH dynamic exec omnislash157/graphyos __import__ sink
env={**__import__("os").environ, **env}, capture_output=True, text=True) - HIGH dynamic exec omnislash157/graphyos eval()/exec()
return eval(compile(expr, "<residual_prefixes>", "eval"), {"frozenset": frozenset}, {}) - HIGH dynamic exec somoore/pairputer-on-aws eval()/exec()
exec(compile(module, "server.py:_resource_meta", "exec"), namespace) - HIGH dynamic exec somoore/pairputer-on-aws eval()/exec()
exec(compile(module, "server.py:_drain_relay", "exec"), namespace) - HIGH dynamic exec somoore/pairputer-on-aws eval()/exec()
exec(compile(module, "server.py:persist-helpers", "exec"), namespace)