A code scanner flagged a generic suspicious text pattern on line 1, but line 1 is just a plugin name comment. The code is fully readable, uses only standard platform APIs, and shows no hidden or harmful behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.suspicious-literal. The match applies to this repository.
Contextual assessment: JS-X-Ray flagged a static suspicious-literal signal on line 1, which is the plugin metadata comment `//@name Webnovel_Serial_v0.1.0`. The scanner itself notes matched literal values were not retained, so the specific trigger is unknown. Reviewing the full supplied source, the plugin uses only standard RisuAI plugin APIs (pluginStorage, runLLMModel, getArgument, getCurrentCharacterIndex, getCurrentChatIndex, getChatFromIndex). All data flows are local: chat messages are read from the platform's own chat index, processed into prompts, sent to the platform's LLM API, and results are stored back in pluginStorage with character/chat-scoped keys. There are no external network calls, no credential access, no eval or Function constructors, no obfuscation, and no concealed execution. The code is clearly structured with Korean-language comments explaining each section. The flagged literal is a false positive from heuristic static analysis on a metadata comment line.