Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51193 analyzed
7507 re-analysis due
995 not analyzable
0 not yet analyzed
4848 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12007
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190152
- HIGH dynamic exec balanced7/akashic-aurora eval()/exec()
total_rss += float(eval(mem_str) if "*" in mem_str else mem_str) - HIGH dynamic exec balanced7/akashic-aurora eval()/exec()
total_rss += float(eval(mem_str) if "*" in mem_str else mem_str) - HIGH dynamic exec balanced7/akashic-aurora eval()/exec()
exec(code, exec_globals) - HIGH dynamic exec balanced7/akashic-aurora eval()/exec()
exec(code, exec_globals) - HIGH dynamic exec balanced7/akashic-aurora eval()/exec()
total_rss += float(eval(mem_str) if "*" in mem_str else mem_str) - HIGH dynamic exec balanced7/akashic-aurora __import__()
return __import__(f"{__package__}.practice_riff", fromlist=["main"]).main(argv[1:]) - HIGH dynamic exec balanced7/akashic-aurora __import__()
mod = __import__(PATTERN_MODULE) - MEDIUM suspicious endpoint MatthiasLew/ai-dev-cli-tools 35.209.177.185
expected = "https://35.209.177.185.sslip.io/v1/events" - MEDIUM suspicious endpoint MatthiasLew/ai-dev-cli-tools 35.209.177.185
DEFAULT_COMMUNITY_ENDPOINT = "https://35.209.177.185.sslip.io/v1/events" - MEDIUM suspicious endpoint cluefinch 8.8.8.8
URL = "https://8.8.8.8/source" - MEDIUM suspicious endpoint cluefinch 8.8.8.8
await fetcher._download("https://8.8.8.8/") - HIGH committed secret zombopanda/agent-crossbar Anthropic key
sk-ant…(45 chars, redacted) - HIGH committed secret zombopanda/agent-crossbar Anthropic key
sk-ant…(39 chars, redacted) - HIGH dynamic exec zombopanda/agent-crossbar __import__()
sys.modules[_full] = __import__(_target, fromlist=[_mod_name]) - MEDIUM suspicious endpoint dennismenken/buchhaltungsbutler-mcp 93.184.216.34
assertUrlShapeAllowed(new URL("https://93.184.216.34/beleg.pdf"));