Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50108 analyzed
8067 re-analysis due
988 not analyzable
0 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187702
- HIGH dynamic exec pacphi/agentic-kit vm exec
const budget = (timeout, override) => vm.runInNewContext(`(${functionSource})()`, { - HIGH committed secret pacphi/agentic-kit Anthropic key
sk-ant…(37 chars, redacted) - HIGH committed secret pacphi/agentic-kit Anthropic key
sk-ant…(37 chars, redacted) - HIGH committed secret pacphi/agentic-kit Anthropic key
sk-ant…(39 chars, redacted) - HIGH dynamic exec pacphi/agentic-kit vm exec
const ctxChip = vm.runInNewContext(`(${snippet.trim()})`, { esc: String, fmtTok: String }); - HIGH dynamic exec pacphi/agentic-kit new Function()
const liveEsc = new Function(`return (${line.trim().replace(/^function esc/, 'function')});`)(); - HIGH dynamic exec pacphi/agentic-kit new Function()
return new Function(...Object.keys(deps), `${source}\nreturn {${bindings.join(',')}};`)(...Object.values(deps)); - HIGH dynamic exec pacphi/agentic-kit new Function()
return new Function(...Object.keys(deps),source+'\nreturn {'+exports.join(',')+'};')(...Object.values(deps)); - HIGH dynamic exec pacphi/agentic-kit new Function()
const run = new Function('authHeaders', 'esc', 'ago', body); - HIGH dynamic exec pacphi/agentic-kit vm exec
vm.runInNewContext(source, context); - HIGH obfuscation pacphi/agentic-kit dynamic require()/import()
const twice = await import(`${MODULE_URL}?instance=2`); - HIGH committed secret pacphi/agentic-kit Anthropic key
sk-ant…(37 chars, redacted) - HIGH obfuscation pacphi/agentic-kit dynamic require()/import()
const { startDashboard: realStartDashboard } = await import('file://' + MOD); - HIGH dynamic exec pacphi/agentic-kit new Function()
new Function(JS); // parse-only (no execution) - HIGH obfuscation pacphi/agentic-kit dynamic require()/import()
const C = await import('file://' + COLLECT);