Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50108 analyzed
8067 re-analysis due
988 not analyzable
0 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187702
- HIGH dynamic exec Highsteads/ClaudeBridge eval()/exec()
value = eval(compile(code, "<mcp_exec>", "eval"), ns) # noqa: S307 - HIGH dynamic exec Highsteads/ClaudeBridge eval()/exec()
exec(code, ns) # noqa: S102 - HIGH committed secret getrunkite/runkite private key
PEM private key block (redacted) - HIGH dynamic exec getrunkite/runkite eval()
const bareArrow = eval("x => x") as (x: unknown) => unknown; - HIGH credential in log termux-mcp credential in log
logger.info("Auth token configured (length=%d)", len(AUTH_TOKEN)) - HIGH dynamic exec Brohammad/VoxForge __import__ sink
**dict(__import__("os").environ), - HIGH dynamic exec jimmyrivas/bifrost new Function()
const fn = new Function( - HIGH dynamic exec jimmyrivas/bifrost vm exec
const result = vm.runInNewContext(wrappedCode, sandbox, { - HIGH obfuscation larasrinath/Xanaplan dynamic require()/import()
await import('data:text/javascript,' + encodeURIComponent(source)); - HIGH committed secret shawn-durrani/membro Anthropic key
sk-ant…(49 chars, redacted) - HIGH obfuscation asynx6/tokenzip dynamic require()/import()
await import(`./hooks/${argv[1] || 'claude-code'}.mjs`); - HIGH dynamic exec toolbase unsafe yaml.load()
data = yaml.load(f) - HIGH obfuscation cckyros/goal-acceptance dynamic require()/import()
const mod = await import("data:text/javascript;base64," + Buffer.from(code).toString("base64")); - HIGH dynamic exec myrrazor/atlas-tasker vm exec
vm.runInNewContext(script, context, { filename: 'app.js' }); - HIGH dynamic exec Sahith59/AgentMem-OS __import__ sink
__import__("os").environ.get("AGENTMEM_OS_TEST_LIVE_REDIS") != "1",