Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50100 analyzed
8073 re-analysis due
988 not analyzable
2 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187699
- MEDIUM suspicious endpoint tenkenco/declaude www.google-analytics.com (telemetry)
assert any(src == "https://www.google-analytics.com" for src in d["connect-src"]) - MEDIUM suspicious endpoint tenkenco/declaude www.google-analytics.com (telemetry)
ANALYTICS = ("https://www.googletagmanager.com https://www.google-analytics.com " - MEDIUM over-broad oauth scope hiqra694-alt/Aether-Agentic-Workspace gmail.modify
"https://www.googleapis.com/auth/gmail.modify", - HIGH dynamic exec hiqra694-alt/Aether-Agentic-Workspace eval()/exec()
result = eval(expression, {"__builtins__": None}, {}) - MEDIUM suspicious endpoint croakingtoad/yardmaster x.ngrok.io
async () => await registry.updateNgrokUrl('ghost', 'https://x.ngrok.io') - MEDIUM suspicious endpoint croakingtoad/yardmaster abc.ngrok.io
await registry.updateNgrokUrl('tunneled', 'https://abc.ngrok.io'); - MEDIUM suspicious endpoint croakingtoad/yardmaster target.ngrok.io
await urlWriter.updateNgrokUrl('target', 'https://target.ngrok.io'); - MEDIUM suspicious endpoint croakingtoad/yardmaster audit-degraded.ngrok.io
const listener = new TestListener('https://audit-degraded.ngrok.io'); - MEDIUM suspicious endpoint croakingtoad/yardmaster abc123.ngrok.io
await logger.logTunnelCreated('test-app', 3000, 'https://abc123.ngrok.io'); - MEDIUM suspicious endpoint croakingtoad/yardmaster test.ngrok.io
await logger.logRegister('test-app', 3000, 'https://test.ngrok.io'); - HIGH credential in log croakingtoad/yardmaster credential in log
console.log(`ngrok Auth Token: ${safeConfig.ngrok.auth_token}`); - HIGH obfuscation TupleBase/tuplebase-vscode dynamic require()/import()
const mod = await import('data:text/javascript;base64,' + Buffer.from(outputFiles[0].text).toString('base64')) - HIGH dynamic exec golproductions/envie indirect eval
importScripts: function () { for (let i = 0; i < arguments.length; i++) { const s = readSync(arguments[i]); if (s) { try { (0, eval)(s); } catch (e) {} } } } - HIGH dynamic exec golproductions/envie new Function()
try { run = new Function('__scope__', 'with (__scope__) { ' + src + ' }'); } - HIGH dynamic exec torfeu/owui-mcp-spawner eval()/exec()
exec(exported["content"], namespace)