Code analysis
static source read inferred
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
50020 analyzed
8131 re-analysis due
988 not analyzable
1 not yet analyzed
4803 source gone
not analyzable
789 too large 199 no source
Running analyzer v33. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 338
- committed secret 6177
- dynamic exec 11826
- obfuscation 3575
- suspicious endpoint 12346
- credential in log 713
- over-broad oauth scope 2548
- suspicious skill script 185
- bundled IDE extension 49
- skill file 187620
- HIGH credential in log mountainmystic/hederatoolbox credential in log
console.error(`[Access] Granted ${tool_name} to ${api_key}`); - HIGH credential in log mountainmystic/hederatoolbox credential in log
console.error(`[Provenance] Write failed for ${toolName}/${apiKey}: ${e.message}`); - HIGH credential in log mountainmystic/hederatoolbox credential in log
console.log(` API key: ${API_KEY}`); - HIGH credential in log mountainmystic/hederatoolbox credential in log
console.log(` PROPOSAL_ID=${p.proposal_id} TOKEN_ID=${TOKEN_ID} TOPIC_ID=${TOPIC_ID} HEDERA_ACCOUNT_ID=${API_KEY} node examples/dao-monitor-agent.mjs --analyze`); - HIGH dynamic exec AjXKai/task-flow-chart eval()
func = eval('(' + source + ')'); // eslint-disable-line no-eval - HIGH dynamic exec AjXKai/task-flow-chart eval()
func = eval('(' + source + ')'); // eslint-disable-line no-eval - HIGH dynamic exec AjXKai/task-flow-chart eval()
func = eval('(' + source + ')'); // eslint-disable-line no-eval - HIGH dynamic exec AjXKai/task-flow-chart eval()
inlineSettings[attrName] = eval(attrValue); - HIGH dynamic exec AjXKai/task-flow-chart eval()
inlineSettings[attrName] = eval(attrValue); - HIGH dynamic exec AjXKai/task-flow-chart new Function()
return ( new Function( "return " + data ) )(); - HIGH dynamic exec AjXKai/task-flow-chart eval()
eval('WF.jsPlumbWorkFlowObjOptions["on_init_function"] = ' + WF.jsPlumbWorkFlowObjOptions["on_init_function"] + ';'); - HIGH dynamic exec AjXKai/task-flow-chart eval()
eval('WF.taskFlowChartObjOptions["on_init_function"] = ' + WF.taskFlowChartObjOptions["on_init_function"] + ';'); - HIGH dynamic exec homeassistant-ai/ha-mcp eval()/exec()
exec(PROBE_HELPERS_SOURCE, namespace) - HIGH dynamic exec homeassistant-ai/ha-mcp unsafe yaml.load()
return yaml.load(_CONFIG_YAML.read_text(encoding="utf-8"), _TagTolerantLoader) - MEDIUM suspicious endpoint homeassistant-ai/ha-mcp 8.8.8.8
("http://8.8.8.8:8123", True),