Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50108 analyzed
8067 re-analysis due
988 not analyzable
0 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187702
- MEDIUM suspicious endpoint aytzey/paper-pilot 169.254.169.254 (cloud metadata)
assert is_public_http_url("http://169.254.169.254/latest/meta-data") is False - MEDIUM suspicious endpoint aytzey/paper-pilot 93.184.216.34
assert is_public_http_url("https://93.184.216.34/paper.pdf") is True - HIGH dynamic exec Jovancoding/Network-AI eval()
eval(userInput); - HIGH committed secret cirwel/unitares-governance-plugin Anthropic key
sk-ant…(34 chars, redacted) - HIGH committed secret cirwel/unitares-governance-plugin Anthropic key
sk-ant…(37 chars, redacted) - HIGH credential in log tinyorbitvn/codex-imagegen-mcp credential in log
log.info("thử", { client_secret: "không-được-lộ" }); - HIGH dynamic exec All-The-Vibes/ATV-Phoenix eval()/exec()
exec(compile(candidate, str(solution), "exec"), module.__dict__) - HIGH dynamic exec All-The-Vibes/ATV-Phoenix eval()/exec()
exec(skill.source, namespace) # noqa: S102 - the agent's own code - HIGH dynamic exec All-The-Vibes/ATV-Phoenix eval()/exec()
exec(code, ns) # noqa: S102 - executing model code is the design - HIGH dynamic exec All-The-Vibes/ATV-Phoenix eval()/exec()
never = eval(s.split("never once on ")[1]) # noqa: S307 - HIGH dynamic exec All-The-Vibes/ATV-Phoenix eval()/exec()
exec(compile(code, "<cell>", "exec"), ns) # noqa: S102 - HIGH dynamic exec All-The-Vibes/ATV-Phoenix eval()/exec()
return bool(eval(expr, {}, {"text": message.lower()})) # noqa: S307 - HIGH dynamic exec All-The-Vibes/ATV-Phoenix eval()/exec()
exec(source, ns) # noqa: S102 - the agent's own code, same as a turn cell - MEDIUM over-broad oauth scope kdpa-llc/mcp-compression-proxy delete_repo
cache.saveCompressed('github', 'delete_repo', 'compressed', 'original'); - HIGH committed secret askalf/redstamp Anthropic key
sk-ant…(31 chars, redacted)