Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50108 analyzed
8067 re-analysis due
988 not analyzable
0 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187702
- HIGH committed secret Abidemialade/mylonite Anthropic key
sk-ant…(37 chars, redacted) - HIGH committed secret Abidemialade/mylonite Anthropic key
sk-ant…(36 chars, redacted) - MEDIUM suspicious endpoint Abidemialade/mylonite 169.254.169.254 (cloud metadata)
assert not host_allowed("http://169.254.169.254/latest/meta-data/", al) - MEDIUM suspicious endpoint git-agentic/pkg-registry 169.254.169.254 (cloud metadata)
() => assertAllowedTarballUrl("http://169.254.169.254/latest/meta-data", registry, []), - HIGH obfuscation git-agentic/pkg-registry base64 decode → exec sink
const stage = Buffer.from(packed, "base64").toString("utf8"); - HIGH dynamic exec git-agentic/pkg-registry new Function()
const factory = new Function("_", "return function " + functionName + "(){ return _; }"); - HIGH obfuscation git-agentic/pkg-registry base64 decode → exec sink
var stage = Buffer.from(_0x, "base64").toString("utf8"); - HIGH dynamic exec git-agentic/pkg-registry eval()
eval(stage); - HIGH credential in log VineetV2/peon-mem credential in log
await logger.log("request_in", { path: "/sessions", apiKey: "sk-live-shouldhide" }); - HIGH committed secret VineetV2/peon-mem Anthropic key
sk-ant…(33 chars, redacted) - MEDIUM suspicious endpoint HuangYincan/VideoNote-MCP 8.8.8.8
["http://8.8.8.8/x", "https://1.1.1.1/x", "http://114.114.114.114/v"], - MEDIUM suspicious endpoint HuangYincan/VideoNote-MCP 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data/", - MEDIUM suspicious endpoint HuangYincan/VideoNote-MCP 169.254.169.254 (cloud metadata)
resp = json.loads(server.inspect_video("http://169.254.169.254/latest/meta-data/")) - MEDIUM suspicious endpoint HuangYincan/VideoNote-MCP 169.254.169.254 (cloud metadata)
stream_download("http://169.254.169.254/latest/meta-data/", "/tmp/x.mp4") - MEDIUM suspicious endpoint HuangYincan/VideoNote-MCP 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data/",