No material or immediate-danger item was identified.
Expected scanner matches (20)
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This is a regular input-format check for RPG status bars. It only parses text describing current and maximum values, and the supplied evidence shows no external communication or code execution.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged expression is a bounded-purpose parser for a status-bar line. Its captures are numeric fields and an optional label, followed by local state updates. The supplied context shows no attacker-controlled execution, persistence, credential handling, or external destination associated with this match.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- core/horaeManager.js:1752
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The flagged pattern is used to clean special tags inside thought blocks so the host application does not accidentally remove surrounding text. The available evidence shows ordinary text processing, not harmful behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The reported regular expression operates on message text and replaces matching Horae tags within matched thought blocks with alternate delimiters. It has no demonstrated external input sink, network destination, credential access, code execution, persistence, or concealed behavior. Although nested broad matching can theoretically cause excessive processing on adversarially crafted very large input, the supplied evidence does not establish a practical denial-of-service condition in this use context.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:20381
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This expression removes a leading emoji from an item name so the memory system can store the item consistently. It does not execute code or access sensitive data.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged expression is a bounded Unicode character-class match applied to a parsed item-name string, followed by removal of the matched prefix. The supplied context shows no attacker-controlled execution, external destination, persistence, or sensitive-data flow. The scanner signal is therefore a parsing regex rather than a security vulnerability.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- core/horaeManager.js:1438
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This expression recognizes an emoji at the beginning of an item name. It is normal formatting logic for the inventory feature and does not create a security risk.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged expression is a Unicode-aware, anchored emoji-prefix matcher used to extract an optional icon before ordinary item parsing. Its input is processed as application text, and the supplied evidence shows no dangerous sink, unbounded externally triggered computation, or sensitive-data handling.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- core/horaeManager.js:1410
JavaScript analysis reported javascript.download-to-execution
Expected behavior · low confidence
Detailed wording was omitted by the public report safety filter.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: The candidate is based on a broad correlation between network retrieval and an execution sink in a large production representation. The supplied source context contains client-side file and blob handling for table import/export, JSON parsing, DOM rendering, and ordinary application persistence, but does not identify a network response flowing into dynamic code execution or command execution. No concealed execution, credential collection, or unrelated external destination is demonstrated by the supplied evidence. The assessment is therefore limited to the visible context and scanner metadata; deeper portions of the file are not independently characterized here.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- index.js:1912-3604
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This code reads structured Horae tags from AI messages. The flagged pattern is used to find table-style memory blocks, which matches the extension's stated parsing function and does not itself show harmful behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The reported signal is a regular expression applied to message text to extract horaetable blocks. It is fixed, local parsing logic for the documented memory-table format; the supplied evidence shows no attacker-controlled regex construction, external transmission, credential access, or concealed execution. Although complex regexes can warrant performance testing, this candidate alone does not establish a security vulnerability or malicious behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- core/horaeManager.js:1326
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The flagged pattern is used to clean and recognize configured embedding-service addresses. It does not by itself execute code or expose information.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The candidate is a fixed regular expression used for endpoint and model-name classification and URL normalization. The supplied context shows no attacker-controlled pattern compilation, code execution, secret disclosure, or evidence of catastrophic backtracking; the expressions are bounded by simple literals, character classes, and optional groups applied to configuration strings already used for API routing.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- core/vectorManager.js:2164
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The flagged pattern is used to remove configured markup from roleplay text. It is part of the extension’s stated text-cleaning and memory-processing features, not evidence of harmful behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The candidate corresponds to a dynamically constructed regular expression that escapes a user-configured tag name, then removes matching XML-like blocks. The surrounding code shows bounded, purpose-specific input sanitization for summary and vector-analysis inputs; no external destination, credential access, persistence, or concealed execution is shown. The supplied evidence does not demonstrate catastrophic backtracking or attacker-controlled execution.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:18301
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The flagged pattern removes structured memory tags from text before search. It is part of the extension's stated memory-cleaning function and does not show harmful behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regular expression is a fixed, case-insensitive, non-global pattern used to strip bounded custom markup from locally processed text. The supplied context shows no attacker-controlled pattern construction, external destination, credential handling, or execution beyond text transformation. Although nested or unusually large tags could affect processing efficiency, the evidence does not establish a practical denial-of-service condition in this use.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- core/vectorManager.js:2059
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · medium confidence
The flagged pattern is used to remove an optional emoji prefix from an item name while matching inventory entries. It is a short, fixed expression used during a user-clicked item-lock action, not an operation involving secrets, external destinations, or hidden execution.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The scanner signal corresponds to a bounded Unicode-prefix regular expression applied to object keys during an item lookup. The expression has no nested repetition or attacker-controlled pattern construction, and execution occurs only in the UI event handler. Supplied evidence shows local chat-state mutation and saving, with no network or credential flow associated with the match. The scanner finding does not establish a practical regular-expression denial-of-service condition here.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:6633
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The flagged pattern is used to remove version suffixes from a user-configured API address before building an embedding request. It is not evidence of hidden execution or data theft.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The candidate corresponds to a fixed regular expression that normalizes endpoint paths by matching API version segments. In the supplied context it only transforms the configured URL; it does not execute generated input, access credentials beyond the intended API request, or establish persistence. The auxiliary API and embedding behavior are disclosed as project features and are proportionate to a memory extension's purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:17077
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The flagged pattern is used to remove leftover Horae markup from displayed messages. It does not contact a server, execute code, or handle credentials.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regular expression is a fixed, case-insensitive tag-matching pattern applied to text nodes during message rendering. Its input is local DOM text, and the replacement only removes matched markup. The pattern is short and structurally bounded, with no attacker-controlled nested repetition or external side effect.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:21277
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This is another format check used to recognize an RPG status-bar entry when the owner is omitted. It processes local text and does not, in the supplied evidence, expose data or run commands.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged expression parses a user-only RPG bar using fixed structural delimiters, numeric values, and an optional label. The surrounding code conditionally applies the result to in-memory RPG state. No harmful sink, network destination, persistence mechanism, or credential flow is shown.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- core/horaeManager.js:1751
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This pattern only detects an emoji at the beginning of an item name. It does not process network data, credentials, or commands.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged expression is a bounded Unicode-range prefix match applied to an item-name string, followed by removal of the matched emoji. The supplied context shows no attacker-controlled repetition, expensive nesting, or security-sensitive sink.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- core/horaeManager.js:4479
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · medium confidence
The flagged pattern only removes trailing path segments from a user-configured API address before building the request address. It is ordinary URL cleanup for an extension that calls model providers, not evidence of harmful behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The cited expression is applied to rawUrl to normalize an endpoint by stripping trailing slashes, a chat-completions suffix, and an API version path. The surrounding code then constructs the documented Gemini-compatible request endpoint and sends the prompt using the configured API key. No attacker-controlled regex input, concealed execution, credential exfiltration, or unrelated destination is shown by this evidence.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:17644
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The flagged pattern is used to recognize timeline sections in generated memory text. The supplied code does not show attacker-controlled execution or sensitive-data handling.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regular expression is a fixed parser pattern applied to lines from a prompt string while splitting a timeline section. Its apparent use is proportional to the extension's memory-engine purpose, and the supplied evidence shows no external destination, code evaluation, credential access, or persistence associated with it.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:20753
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · medium confidence
The flagged pattern appears to parse Horae memory-table markup, which matches the extension’s stated memory-engine purpose. The supplied evidence does not show attacker-controlled input, dangerous execution, or external data transmission.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The only supplied production source is a global, case-insensitive regular expression matching an opening and closing horaetable element across arbitrary characters. Although nested, broad matching can have performance implications on adversarially large input, the evidence does not establish reachable user-controlled inputs, catastrophic backtracking, denial-of-service impact, or malicious behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:1
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This pattern removes an optional emoji prefix from a deleted item name. It is ordinary parsing for the inventory feature.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The expression is a single anchored character-class match with Unicode mode, used once on a trimmed parsed item name. Its structure is linear and does not indicate catastrophic backtracking or a harmful data flow.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- core/horaeManager.js:4445
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The flagged pattern is used to clean up a user-entered API address before requesting its model list. It does not process chat content or execute downloaded code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The reported regular expression removes trailing slashes, an optional chat-completions suffix, and version-like path segments from a configured endpoint. The supplied context shows bounded matching and ordinary URL normalization before an explicit model-list fetch; no catastrophic backtracking, secret exfiltration, or concealed execution is evidenced. Its use is proportionate to the documented auxiliary-provider configuration.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:17306
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The flagged pattern is used to read Horae table markup from AI messages. It does not show credential access, external communication, hidden execution, or harmful persistence.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The supplied code applies a case-insensitive regular expression with a non-greedy capture to extract table names and contents from message text, then parses those contents into application state. This matches the extension's documented custom-table and AI-update functionality. The evidence does not establish catastrophic backtracking, attacker-controlled repeated processing at a harmful scale, or a security-impacting execution path.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- core/horaeManager.js:4579