The scanner thought it might find hidden code, but looking at the actual source, the code is clean, open, and easy to read. There is no hidden or scrambled code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged 'obfuscated-code' at line 1 with low confidence. The supplied source code is plain, readable JavaScript with clear comments in Korean and English, standard variable names, and no minification, packer signatures, eval-based dispatching, or encoded payloads. The IIFE wrapper at line 7 is a standard module pattern. No obfuscation is evident.
The plugin sends your OpenAI API key and image data to OpenAI's servers to generate images, which is exactly what the plugin is designed to do. There is no evidence of it sending your data to any other hidden or suspicious websites.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The scanner flagged 'shady-link' near line 355. The code at that location handles collecting reference images from local plugin storage and building multipart form data for the OpenAI image edits API. The only network destinations are the user-configurable config.endpoint and config.editsEndpoint, which default to api.openai.com. The API key is sent only as a Bearer token to these endpoints via risuai.nativeFetch. This is the expected data flow for a plugin whose stated purpose is direct OpenAI image generation. No hardcoded suspicious URLs or data exfiltration to third parties is present.