Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50108 analyzed
8067 re-analysis due
988 not analyzable
0 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187702
- HIGH hidden prompt event4u-app/agent-config skill: hidden-directive
DESCRIPTION RULES (delete this comment when done): - Start with "Use when..." — this is a TRIGGER, not a summary - Include 2-3 phrases users actually say: "create a DTO", "add column", "fix tests" - HIGH hidden prompt event4u-app/agent-config skill: hidden-directive
DESCRIPTION RULES (delete this comment when done): - Start with "Use when..." — this is a TRIGGER, not a summary - Include 2-3 phrases users actually say: "create a DTO", "add column", "fix tests" - HIGH committed secret MC-kakadu/AIexpose Anthropic key
sk-ant…(49 chars, redacted) - HIGH committed secret MC-kakadu/AIexpose Anthropic key
sk-ant…(39 chars, redacted) - HIGH committed secret MC-kakadu/AIexpose HuggingFace token
hf_dep…(35 chars, redacted) - HIGH committed secret MC-kakadu/AIexpose Slack token
xoxb-o…(33 chars, redacted) - HIGH committed secret MC-kakadu/AIexpose Slack token
xoxb-o…(25 chars, redacted) - HIGH dynamic exec GuangminJu/mellos-mapping new Function()
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); - HIGH dynamic exec caichaojie1987/lingxu-agent-engine new Function()
const cleanNarration = new Function(`${fnSrc}; return cleanNarration;`)(); - HIGH dynamic exec tigu77/tiguclaw new Function()
: (new Function("h", m[1]!) as (h: unknown) => string[]); - HIGH dynamic exec tigu77/tiguclaw new Function()
const view = new Function( - HIGH dynamic exec tigu77/tiguclaw new Function()
const pctOf = new Function("cached", "shownIn", `return ${m[1] ?? "0"};`) as ( - HIGH dynamic exec tigu77/tiguclaw vm exec
vm.runInNewContext(code, { exports, require: requireFixture, AbortController, process: { cwd: () => "/fixture" }, console: { log() {}, warn() {}, error() {} }, setTimeout, clearTimeout }, { filename } - HIGH dynamic exec tigu77/tiguclaw new Function()
const run = new Function( - HIGH obfuscation tigu77/tiguclaw dynamic require()/import()
const mod = (await import(`./${f.replace(/\.ts$/, ".js")}`)) as {