Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51308 analyzed
7409 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- MEDIUM over-broad oauth scope timainge/iobox gmail.modify
"https://www.googleapis.com/auth/gmail.modify", - MEDIUM over-broad oauth scope timainge/iobox gmail.modify
has_modify = any("gmail.modify" in s for s in creds.scopes) - MEDIUM over-broad oauth scope timainge/iobox https://www.googleapis.com/auth/drive
DRIVE_SCOPES_STANDARD: list[str] = ["https://www.googleapis.com/auth/drive"] - MEDIUM over-broad oauth scope timainge/iobox gmail.modify
"https://www.googleapis.com/auth/gmail.modify", - HIGH obfuscation mzizi-dev/mzizi-registry dynamic require()/import()
const mod = (await import(`@/components/registry/${rel}.tsx`)) as Record<string, unknown> - HIGH dynamic exec atharvmantri/MemoryGuard __import__()
_mod = __import__(_candidate, fromlist=["IngestionInspector"]) - HIGH dynamic exec atharvmantri/MemoryGuard __import__()
_mod = __import__(_candidate, fromlist=["IngestionInspector"]) - HIGH dynamic exec linxule/lotus-wisdom-mcp new Function()
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); - MEDIUM suspicious endpoint psyb0t/docker-aicodebox api.telegram.org
url = f"https://api.telegram.org/bot{token}/sendMessage" - MEDIUM over-broad oauth scope blackwings-dev/gmail-multi-mcp https://www.googleapis.com/auth/drive
export const DRIVE_SCOPES = ['https://www.googleapis.com/auth/drive'] as const; - MEDIUM over-broad oauth scope blackwings-dev/gmail-multi-mcp gmail.modify
export const GMAIL_SCOPES = ['https://www.googleapis.com/auth/gmail.modify'] as const; - HIGH committed secret cpex-secrets-detection Google API key
AIzaAA…(39 chars, redacted) - MEDIUM suspicious endpoint takashi000/ollama-web 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data", - MEDIUM suspicious endpoint takashi000/ollama-web 169.254.169.254 (cloud metadata)
"http://169.254.169.254/latest/meta-data", - MEDIUM suspicious endpoint pictify-io/mcp us.i.posthog.com (telemetry)
const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";