Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50064 analyzed
8099 re-analysis due
988 not analyzable
0 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6178
- dynamic exec 11834
- obfuscation 3579
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187628
- HIGH committed secret talirezun/the-curator GitHub fine-grained PAT
github…(38 chars, redacted) - HIGH committed secret talirezun/the-curator private key
PEM private key block (redacted) - HIGH dynamic exec talirezun/the-curator new Function()
const make = new Function( - HIGH dynamic exec talirezun/the-curator new Function()
splitWikiRef = new Function(src + '\nreturn splitWikiRef;')(); - HIGH dynamic exec talirezun/the-curator new Function()
return new Function(...injectedNames, combined)(...injectedNames.map((k) => inject[k])); - HIGH obfuscation talirezun/the-curator dynamic require()/import()
const { default: router } = await import(${JSON.stringify(pathToFileURL(path.join(PROJECT_ROOT, 'src/routes/domains.js')).href)}); - HIGH dynamic exec talirezun/the-curator new Function()
return new Function(...m.injected, body); - HIGH obfuscation talirezun/the-curator dynamic require()/import()
const hook = await import(`file://${hookPath}`); - HIGH dynamic exec talirezun/the-curator new Function()
const clientTitleFromSlug = new Function('slug', tfsMatch[1]); - HIGH obfuscation talirezun/the-curator dynamic require()/import()
try { OLD = await import(`../src/brain/${path.basename(BC_PATH)}`); } - HIGH obfuscation talirezun/the-curator dynamic require()/import()
import('${path.resolve('src/brain/atomic-write.js').replace(/\\\\/g, '/')}').then(async ({ writeFileAtomic }) => { - HIGH dynamic exec talirezun/the-curator new Function()
return new Function('__calls', preamble + nextBodies.join('\n\n') + '\n' + api)(calls).__attach === undefined - HIGH obfuscation talirezun/the-curator dynamic require()/import()
const cfgMod = await import(`../src/brain/config.js?live=${Date.now()}`); - HIGH dynamic exec talirezun/the-curator new Function()
R = new Function(...names, body)(...names.map((n) => INJECTED[n])); - HIGH dynamic exec talirezun/the-curator new Function()
return new Function(