Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50100 analyzed
8073 re-analysis due
988 not analyzable
2 not yet analyzed
4804 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6180
- dynamic exec 11839
- obfuscation 3598
- suspicious endpoint 12356
- credential in log 713
- over-broad oauth scope 2550
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187701
- HIGH dynamic exec talirezun/the-curator new Function()
return new Function(...injectedNames, combined)(...injectedNames.map((k) => inject[k])); - HIGH obfuscation talirezun/the-curator dynamic require()/import()
const { default: router } = await import(${JSON.stringify(pathToFileURL(path.join(PROJECT_ROOT, 'src/routes/domains.js')).href)}); - HIGH dynamic exec talirezun/the-curator new Function()
return new Function(...m.injected, body); - HIGH obfuscation talirezun/the-curator dynamic require()/import()
const hook = await import(`file://${hookPath}`); - HIGH dynamic exec talirezun/the-curator new Function()
const clientTitleFromSlug = new Function('slug', tfsMatch[1]); - HIGH obfuscation talirezun/the-curator dynamic require()/import()
try { OLD = await import(`../src/brain/${path.basename(BC_PATH)}`); } - HIGH obfuscation talirezun/the-curator dynamic require()/import()
import('${path.resolve('src/brain/atomic-write.js').replace(/\\\\/g, '/')}').then(async ({ writeFileAtomic }) => { - HIGH dynamic exec talirezun/the-curator new Function()
return new Function('__calls', preamble + nextBodies.join('\n\n') + '\n' + api)(calls).__attach === undefined - HIGH obfuscation talirezun/the-curator dynamic require()/import()
const cfgMod = await import(`../src/brain/config.js?live=${Date.now()}`); - HIGH dynamic exec talirezun/the-curator new Function()
R = new Function(...names, body)(...names.map((n) => INJECTED[n])); - HIGH dynamic exec talirezun/the-curator new Function()
return new Function( - HIGH committed secret talirezun/the-curator GitHub token
ghp_th…(41 chars, redacted) - HIGH committed secret talirezun/the-curator GitHub fine-grained PAT
github…(39 chars, redacted) - HIGH hidden prompt talirezun/the-curator agent-rules: skill-exfil
secret→sink: - **Server binds to 127.0.0.1 only (v3.0.1-beta.20+)** — `app.listen(PORT, '127.0.0.1', ...)`. The Curator is a single-user localhost app; binding to all interfaces (the pre-beta.20 defau - HIGH obfuscation pascalorg/editor dynamic require()/import()
mock.module('@pascal-app/core', () => require(${sourcePath('packages/core/src/index.ts')}))