Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
51308 analyzed
7409 re-analysis due
996 not analyzable
0 not yet analyzed
4850 source gone
not analyzable
796 too large 200 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 369
- committed secret 6298
- dynamic exec 12011
- obfuscation 3650
- suspicious endpoint 12542
- credential in log 718
- over-broad oauth scope 2556
- suspicious skill script 197
- bundled IDE extension 50
- skill file 190167
- HIGH dynamic exec fancyboi999/ai-engineering-from-scratch-zh eval()/exec()
return str(eval(expr, {"__builtins__": {}}, {})) - HIGH dynamic exec fancyboi999/ai-engineering-from-scratch-zh eval()/exec()
return str(eval(expression, {"__builtins__": {}}, {})) - HIGH dynamic exec fancyboi999/ai-engineering-from-scratch-zh eval()/exec()
result = eval(expression, {"__builtins__": {}}, {"math": math}) - HIGH dynamic exec fancyboi999/ai-engineering-from-scratch-zh eval()/exec()
result = eval(expression, {"__builtins__": {}}, {}) - HIGH dynamic exec fancyboi999/ai-engineering-from-scratch-zh eval()/exec()
expected = eval(cleaned, {"__builtins__": {}}, {}) - HIGH dynamic exec maozl/xihe-agent eval()/exec()
exec(byte_code, g) - HIGH dynamic exec maozl/xihe-agent __import__ sink
base = __import__("os").environ.get(env) - HIGH dynamic exec backthread/backthread new Function()
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); - HIGH dynamic exec Harmeet10000/AgentNexus-LangChain-FastAPI __import__()
__import__( - HIGH dynamic exec dxeledx/capyra vm exec
vm.runInNewContext(source, environment); - HIGH dynamic exec dxeledx/capyra vm exec
vm.runInNewContext(cardHtml.match(/<script>([\s\S]*)<\/script>/)![1]!, { window, document, setTimeout, clearTimeout }); - HIGH obfuscation AgentGameLab/mneme dynamic require()/import()
const { initMemory, closeMemory, setLocation, getLocation, importLocations, deleteLocation } = await import('./index.mjs?fresh=' + Math.random()) - MEDIUM suspicious endpoint SamYatesSmith/Tru8 eu.i.posthog.com (telemetry)
sentry.io https://*.ingest.de.sentry.io https://eu.i.posthog.com https://eu-assets.i.posthog.com${devConnect}`, - MEDIUM suspicious endpoint SamYatesSmith/Tru8 eu-assets.i.posthog.com (telemetry)
t.de.sentry.io https://cdn.jsdelivr.net https://eu-assets.i.posthog.com", - MEDIUM suspicious endpoint SamYatesSmith/Tru8 eu.i.posthog.com (telemetry)
const HOST = process.env.NEXT_PUBLIC_POSTHOG_HOST || 'https://eu.i.posthog.com';