Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50066 analyzed
8097 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6178
- dynamic exec 11834
- obfuscation 3579
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187628
- MEDIUM suspicious endpoint Lantern-svg/lantern 93.184.216.34
verdict = _policy().evaluate("https://93.184.216.34") - HIGH obfuscation Maharajahu/toolbraid dynamic require()/import()
const catalogModule = await import(`../../src/providers/recovery/catalog.js?stable-profile=${index}-${Date.now()}`); - HIGH dynamic exec Maharajahu/toolbraid vm exec
vm.runInNewContext(EXTRACTOR_SOURCE, context, { filename: 'page-extractor.js' }); - MEDIUM suspicious endpoint Maharajahu/toolbraid 169.254.169.254 (cloud metadata)
'https://169.254.169.254/latest/', - HIGH dynamic exec Maharajahu/toolbraid vm exec
vm.runInNewContext(EXTRACTOR_SOURCE, context, { filename: 'page-extractor.js' }); - HIGH obfuscation Maharajahu/toolbraid dynamic require()/import()
const module = await import(chrome.runtime.getURL(`src/site-adapters/${kind}.js`)); - HIGH dynamic exec KenTaniguchi-R/ledgr new Function()
new Function(THEME_INIT)(); - HIGH suspicious skill script sonpiaz/watch-cli suspicious bundled script
curl -fsSL https://github.com/sonpiaz/watch-cli/releases/latest/download/install.sh | bash - HIGH dynamic exec annatchijova/vigia-intent-analysis __import__()
mod = __import__(module_name, fromlist=[func_name]) - HIGH dynamic exec annatchijova/vigia-intent-analysis __import__()
module = __import__(module_name, fromlist=[class_name]) - HIGH dynamic exec annatchijova/vigia-intent-analysis eval()/exec()
exec(line, ns) - HIGH dynamic exec ShamanAndrey/kicad-mcp-layer __import__ sink
get_session().seen_live.add(pcb_tools._canon(path) if hasattr(pcb_tools, "_canon") else __import__("os").path.normcase(__import__("os").path.realpath(str(path)))) - HIGH dynamic exec ShamanAndrey/kicad-mcp-layer __import__ sink
pid=__import__("os").getpid(), - HIGH dynamic exec protostatis/unchained-infra eval()/exec()
exec(compile(helper_module, "packaged_cdp_tool.py", "exec"), namespace) - HIGH dynamic exec protostatis/unchained-infra eval()/exec()
exec(reconciler_source, reconciler_module.__dict__)