The plugin code is plain, readable JavaScript that builds a fullscreen lorebook editing interface. There is no hidden or scrambled logic, no secret data collection, and no unexpected network calls. The scanner's obfuscation flag is a false positive.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The supplied source is a straightforward RisuAI plugin written in plain, readable vanilla JavaScript. It requests the documented 'db' permission via risuai.requestPluginPermission, shows a fullscreen container, and injects a large inline HTML/CSS template literal into document.body.innerHTML to build a lorebook management UI. No eval, Function constructor, encoded strings, external fetch/XHR calls, credential access, or concealed execution is present. The scanner's low-confidence obfuscation signal appears to be a false positive triggered by the large template literal or structural patterns, not by genuine obfuscation. The behavior matches the stated project purpose of a fullscreen lorebook editor.
Plugin requests db permission and replaces body content as documented
low risk · high confidence
The plugin replaces the page content with its own editor UI and requests database access to manage lorebook entries. This is the expected behavior for a fullscreen lorebook editor plugin.
Technical assessment
The code calls risuai.requestPluginPermission('db') and risuai.showContainer('fullscreen') then sets document.body.innerHTML to a static HTML/CSS template. This is consistent with the plugin's stated purpose of providing a fullscreen lorebook editing environment using RisuAI's plugin API. No dynamic script injection or external data flows are visible in the supplied source.