Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51193 analyzed
7507 re-analysis due
995 not analyzable
0 not yet analyzed
4848 source gone
not analyzable
795 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12007
- obfuscation 3647
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190152
- HIGH dynamic exec psionski/kinti new Function()
const run = new Function("window", buildRouteRestoreScript()) as (w: unknown) => void; - MEDIUM suspicious endpoint jetapi/jetapi-mcp-server t.me
17: { name: "too_many_requests", label: "Request limit exceeded", final: true, hint: "Telegram reports too many requests; check the account at https://t.me/SpamBot." }, - HIGH credential in log theonaai/linkedin-content-planner-mcp credential in log
console.log(` (unexpected) client_secret: ${client.client_secret}`); - HIGH committed secret alebgl77/ftp-deploy-mcp private key
PEM private key block (redacted) - HIGH credential in log maverick0628/ciphergate credential in log
console.log(`Admin API key (save this — it will not be shown again):\n${apiKey}`); - HIGH committed secret hilather/go-jenkins-mcp private key
PEM private key block (redacted) - HIGH dynamic exec pacphi/agentic-kit eval()
rufloActivationSegments = eval('(function(){' + block + '\nreturn rufloActivationSegments;})()'); - HIGH dynamic exec pacphi/agentic-kit eval()
rufloActivationSegments = eval('(function(){' + block + '\nreturn rufloActivationSegments;})()'); - HIGH dynamic exec pacphi/agentic-kit vm exec
const budget = (timeout, override) => vm.runInNewContext(`(${functionSource})()`, { - HIGH committed secret pacphi/agentic-kit Anthropic key
sk-ant…(37 chars, redacted) - HIGH committed secret pacphi/agentic-kit Anthropic key
sk-ant…(37 chars, redacted) - HIGH committed secret pacphi/agentic-kit Anthropic key
sk-ant…(39 chars, redacted) - HIGH dynamic exec pacphi/agentic-kit vm exec
const ctxChip = vm.runInNewContext(`(${snippet.trim()})`, { esc: String, fmtTok: String }); - HIGH dynamic exec pacphi/agentic-kit new Function()
const liveEsc = new Function(`return (${line.trim().replace(/^function esc/, 'function')});`)(); - HIGH dynamic exec pacphi/agentic-kit new Function()
return new Function(...Object.keys(deps), `${source}\nreturn {${bindings.join(',')}};`)(...Object.values(deps));