Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50108 analyzed
8067 re-analysis due
988 not analyzable
0 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187702
- HIGH dynamic exec yh-l20/yuanxingmu eval()/exec()
exec(Path("calculation.py").read_text(), scope) - HIGH dynamic exec yh-l20/yuanxingmu eval()/exec()
exec(path.read_text(), code) - HIGH dynamic exec howwang0507/Adaptive-Prompt-Compressor eval()/exec()
exec(comp_code, globals(), local_scope) - MEDIUM suspicious endpoint mohanram-dev/ai-workspace 169.254.169.254 (cloud metadata)
await expect(blocked("http://169.254.169.254/latest/meta-data/")).rejects.toMatchObject({ code: "permission_denied" }); - MEDIUM suspicious endpoint mohanram-dev/ai-workspace 169.254.169.254 (cloud metadata)
if (url.pathname === "/redirect-private") return res.writeHead(302, { Location: "http://169.254.169.254/latest/meta-data/" }).end(); - MEDIUM suspicious endpoint nusabyte-my/jebat-core 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data/", - HIGH dynamic exec nusabyte-my/jebat-core __import__()
module = __import__(module_name, fromlist=[""]) - HIGH dynamic exec nusabyte-my/jebat-core eval()/exec()
exec(code, scope) - MEDIUM suspicious endpoint nusabyte-my/jebat-core api.telegram.org
url = f"https://api.telegram.org/bot{self.bot_token}/{method}" - MEDIUM suspicious endpoint nusabyte-my/jebat-core api.telegram.org
url = f"https://api.telegram.org/bot{token}/sendMessage" - MEDIUM suspicious endpoint nusabyte-my/jebat-core discord.com
return self.webhook_url.startswith("https://discord.com/api/webhooks/") - MEDIUM suspicious endpoint nusabyte-my/jebat-core api.telegram.org
self.base_url = f"https://api.telegram.org/bot{bot_token}" - HIGH dynamic exec nusabyte-my/jebat-core __import__()
__import__(mod_path) - HIGH dynamic exec nusabyte-my/jebat-core __import__ sink
env={**dict(__import__("os").environ), **env}, - HIGH dynamic exec nusabyte-my/jebat-core __import__()
__import__(mod_name)