Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51192 analyzed
7507 re-analysis due
995 not analyzable
1 not yet analyzed
4848 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12007
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190152
- MEDIUM suspicious endpoint saxonnicholls/super-log api.telegram.org
await fetch(`https://api.telegram.org/bot${tgToken}/sendMessage`, { - HIGH dynamic exec sleepyquq/xiangsu-mcp vm exec
vm.runInNewContext(js+'\nexports.receive=mcpAudioEvent;',context); - MEDIUM suspicious endpoint alexfrmn/murmur api.telegram.org
const url = `https://api.telegram.org/bot${MURMUR_TELEGRAM_BOT_TOKEN}/sendMessage`; - MEDIUM suspicious endpoint alexfrmn/murmur api.telegram.org
const res = await fetch(`https://api.telegram.org/bot${target.botToken}/sendMessage`, { - MEDIUM suspicious endpoint alexfrmn/murmur api.telegram.org
apiBase: config?.apiBase ?? "https://api.telegram.org", - HIGH credential in log YaoApp/yao credential in log
console.log(` Password: ${ROOT_USER_PASSWORD}`); - HIGH committed secret YaoApp/yao private key
PEM private key block (redacted) - HIGH committed secret YaoApp/yao private key
PEM private key block (redacted) - HIGH committed secret YaoApp/yao private key
PEM private key block (redacted) - MEDIUM over-broad oauth scope ManudotaORG/artist-mcp gmail.modify
'https://www.googleapis.com/auth/gmail.modify', - HIGH dynamic exec phuongddx/jarvis eval()/exec()
exec(code, namespace) - HIGH committed secret refpath/sigil_guard OpenAI key
sk-aB3…(27 chars, redacted) - HIGH obfuscation xiaoanbucai/docwarden dynamic require()/import()
loaded = (await import(new URL(`file://${path.join(WORK, '.knowledge.mjs').replace(/\\/g, '/')}?t=1`).href)).default - MEDIUM suspicious endpoint Scottcjn/beacon-skill 50.28.86.131
BEACON_ATLAS_URL = "https://50.28.86.131/beacon/atlas" - MEDIUM suspicious endpoint Scottcjn/beacon-skill discord.com
webhook_url="https://discord.com/api/webhooks/test/webhook",