Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50064 analyzed
8099 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6178
- dynamic exec 11834
- obfuscation 3579
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187628
- MEDIUM suspicious endpoint Dreftian/Tiancode api.telegram.org
"https://api.telegram.org/bot123:abc/getMe", - MEDIUM suspicious endpoint Dreftian/Tiancode api.telegram.org
"https://api.telegram.org/bot123:abc/getMe", - MEDIUM over-broad oauth scope Dreftian/Tiancode https://www.googleapis.com/auth/cloud-platform
const auth = new GoogleAuth({ scopes: ["https://www.googleapis.com/auth/cloud-platform"] }) - HIGH obfuscation Dreftian/Tiancode dynamic require()/import()
const entryModule = await import(${JSON.stringify(entry)}) - MEDIUM suspicious endpoint Dreftian/Tiancode api.telegram.org
api: (token: string, method: string) => `https://api.telegram.org/bot${token}/${method}`, - HIGH dynamic exec Dreftian/Tiancode new Function()
return new Function(`return (${trimmed})`)() - HIGH committed secret Dreftian/Tiancode Slack token
xoxb-y…(19 chars, redacted) - HIGH obfuscation Dreftian/Tiancode dynamic require()/import()
const generated = await import(`${join(directory, "index.ts")}?t=${crypto.randomUUID()}`) - HIGH committed secret Dreftian/Tiancode Google API key
AIzaSy…(39 chars, redacted) - HIGH dynamic exec Dreftian/Tiancode new Function()
return new Function("input", '"use strict"; return input;')(true) === true - MEDIUM suspicious endpoint Dreftian/Tiancode 1.1.1.1
expect(yield* executeTool(registry, call({ url: "https://1.1.1.1", format: "markdown" }))).toEqual({ - MEDIUM over-broad oauth scope Dreftian/Tiancode https://www.googleapis.com/auth/cloud-platform
expect(googleAuthOptions).toEqual([{ scopes: ["https://www.googleapis.com/auth/cloud-platform"] }]) - MEDIUM over-broad oauth scope Dreftian/Tiancode https://www.googleapis.com/auth/cloud-platform
const auth = new GoogleAuth({ scopes: ["https://www.googleapis.com/auth/cloud-platform"] }) - MEDIUM suspicious endpoint Inferiorrectuscomputerdealer154/coinnect www.google-analytics.com (telemetry)
"connect-src 'self' https://www.google-analytics.com https://region1.google-analytics.com https://cloudflareinsights.com; " - HIGH dynamic exec Collinstudied660/mcp-hub eval()/exec()
if eval(expr, {"__builtins__": {}}, local):