A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The flagged line downloads and runs the standard bun installer from its official website, but only as a fallback for developers setting up a coding environment. This script is not part of what gets installed when a user adds the extension. The practice of downloading and running code directly is generally discouraged, but here it targets a well-known official source and only affects developers, not end users.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: Line 40 contains a curl-pipe-bash pattern that downloads and executes the official bun installer from bun.sh as a fallback when npm install fails. This file is a development setup script for Claude Code sandboxes, not part of the extension runtime. The README confirms that Lumiverse loads only file and dist/backend.js, and that the extension itself makes no external network calls. The curl-pipe-bash pattern is a common but suboptimal practice because it executes remote content without verifying its integrity. However, the URL is the well-known official bun installer, the script is only run by developers setting up a working environment, and it is not shipped to end users through the extension installation path. No demonstrated exposure to extension users exists.
Impact: low · Exploitability: unlikely
Developer action: Consider pinning the bun installer to a specific version and verifying a checksum after download instead of piping curl output directly to bash. This reduces the risk if the download source is ever tampered with.
The test loads the extension into a controlled browser and runs checks against its user interface. The scanner saw a web-page load and code execution in the same file, but they are both normal parts of how automated browser tests work. Nothing is downloaded from the internet and then run.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlated a network-retrieval primitive with a code-execution sink within a large line range of a Playwright test file. The network primitive is page.goto to the fake lumiverse.test origin, whose responses are intercepted and fulfilled locally by page.route. The execution sink is page.evaluate, which runs test-assertion code inside the controlled browser context. There is no download-then-execute pattern: the extension source is injected via page.addScriptTag from a local file read, and all evaluated code is static test logic written in the test file itself. This is standard browser-extension testing methodology.
This is a fake web address used only inside automated tests so the browser's local storage works correctly. No data is sent anywhere; all page content is supplied directly by the test itself.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged literal is a test-only origin constant used to stage Playwright browser tests. The stage() function intercepts all page requests via page.route and fulfills them locally with inline HTML; no real outbound network request reaches any external server. The .test TLD is reserved for testing and the URL exists solely to give the page a real origin so localStorage works during UI checks.
The test reads one environment variable to find where a browser is installed, so it can run UI checks. This is normal test setup and does not touch any credentials or send anything anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.
Contextual assessment: The signal arises from reading process.env.CHROMIUM_PATH to optionally supply a browser executable path to Playwright's chromium.launch. This is standard test-infrastructure configuration: it lets CI or a developer point Playwright at a pre-installed Chromium binary instead of downloading one. No environment secrets are serialized, exfiltrated, or sent anywhere; the value is consumed locally as a filesystem path for the test browser.
The flagged pattern is a text-matching rule used to strip markup from AI replies. It has a built-in length limit so it cannot freeze the browser. The code around it is exactly what an auto-retry extension needs: checking replies for cut-offs, refusals, and other problems. Nothing here sends data anywhere or accesses sensitive information.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The scanner flagged an unsafe-regex signal at the stripMarkup function. The regex in question uses a bounded quantifier limiting repetition to 400 characters, which prevents catastrophic backtracking. The surrounding code consists of text-processing utilities for detecting cut-off replies, refusal patterns, thinking-block stripping, HTML container tracking, color parsing, and selector derivation. All of these match the stated purpose of an auto-retry extension that inspects reply content to decide whether to re-fire. No network calls, credential access, exfiltration, or persistence behavior is visible in the supplied evidence.
The text-matching rule has a safety limit built in, so it will not cause the browser to hang even on unusual input.
Technical assessment
The regex uses an explicit upper bound of 400 on the character class repetition, which eliminates the unbounded backtracking that makes a regex unsafe. JS-X-Ray's static signal does not account for this bound.
curl-pipe-bash fallback for bun installer in dev-only setup script
low risk · high confidence
The setup script for developers has a step that downloads and runs code from the internet without checking it first. This is a common shortcut but is not best practice, as it trusts the download source completely.
Technical assessment
The pattern pipes the output of curl directly into bash, executing remote content without integrity verification. While the target is the official bun.sh installer and the script is development-only, this pattern would execute arbitrary code if the download source were compromised or a man-in-the-middle attack succeeded against the HTTPS connection.
Impact: low · Exploitability: unlikely
Developer action: Download the installer to a file, verify a published checksum, and then execute it only if the checksum matches.