No material or immediate-danger item was identified.
Contextual expected matches (62)
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The addresses flagged are the standard local addresses for two popular free AI tools that run on the user own machine. The plugin lists them so users can connect to these local services.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The two flagged links are loopback addresses for LM Studio and Ollama, which are standard local LLM inference servers. This file is a pure provider-preset module that maps provider names to their default endpoints. Supporting local LLM backends is a core feature of the plugin, and these addresses are well-known defaults for those tools. No external or unexpected destination is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- reference/llm-providers.js:7
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
The file looks scrambled because it was processed by a standard build tool that compresses code for delivery. This is normal for published software and is not an attempt to hide anything.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The obfuscated-code signal is triggered on line 1 of a generated distribution file built by Vite/esbuild. The file header contains standard RisuAI plugin metadata directives (name, version, update-url, args). Minification, bundling, and variable name shortening are expected and normal for a production build artifact. This is not intentional obfuscation to conceal behavior; the project README documents the build process and module structure.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- generated
- Source
- dist/inlaynexus2.0.js:1
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The scanner flagged some regular expressions, but they are ordinary pattern-matching rules used for parsing CSS units and identifiers in the bundled UI code. They do not pose a security risk.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The 20 unsafe-regex signals correspond to standard validation and parsing regex literals in the bundled code, such as numeric-unit matchers, CSS dimension patterns, and identifier validators. These are bounded, non-backtracking patterns used for UI and tag parsing. No catastrophic-backtracking or ReDoS-prone construction is visible in the supplied source windows.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- Asset maid 0.9.2.js:6
Gitleaks reported generic-api-key
Expected behavior · high confidence
An automated scanner thought it saw a possible secret on a line of code, but looking at the actual code, that line is about checking image files for metadata. No real secret or password is visible in the code.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Gitleaks flagged a generic-api-key pattern on line 325, but the matched value was removed by the scanner and is not visible in the supplied source. The code at that location is a function that inspects image assets for NovelAI metadata, creates summaries, and maps selected assets to analysis results. No credential, secret, or API key string is present in the visible code. The generic-api-key rule is a broad pattern matcher prone to false positives on minified bundled JavaScript. There is no demonstrated credential exposure.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- Asset maid 0.9.2.js:325
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a temporary access token baked into a screenshot link in a help document, not a real secret key. It only lets the guide display an image and expires on its own.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The matched value is a key query parameter on an image-hosting CDN URL inside an HTML guide document. It is paired with an expires timestamp and only grants time-limited access to a publicly shared screenshot. It is not a model-provider credential, application secret, or user credential, and the file is a static guide rather than executable code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:333
Gitleaks reported generic-api-key
Expected behavior · high confidence
The flagged value is a temporary link key for displaying a screenshot in a guide page. It only lets someone view that specific image and expires on its own. It is not a password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Line 167 contains an img tag with a source URL on ac.arca.live that includes an expires timestamp and a key query parameter. This key is a time-limited CDN URL signing token for viewing a specific screenshot embedded in a guide HTML file, not an API credential or account secret. It grants no access beyond viewing that one image until the expiry date.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:167
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The scanner saw both a network request and a timer in the same file and flagged the combination. The network request is a standard login flow for the image-generation API, and the timer is just a normal scheduling call. There is no download-then-execute behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The correlation pairs a network retrieval primitive with a scheduling primitive such as setTimeout or requestAnimationFrame. setTimeout is a standard timer, not a dynamic code execution sink. The network call at line 16 is a Vertex AI OAuth JWT-bearer token exchange, which is the legitimate authentication flow for an image-generation plugin that uses model-provider APIs. No evidence shows retrieved content being passed into eval, Function, or similar execution sinks.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- Asset maid 0.9.2.js:6-11
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link key that lets a guide image load from an image-hosting site. It only works for that one picture and expires on its own; it is not a password or API key for any account.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The matched value is a CDN URL-signing key parameter in an image src attribute pointing to the Arca.live image CDN. It is a time-limited access token for displaying a documentation screenshot, not a service API credential or account secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:207
JavaScript analysis reported javascript.xray.encoded-literal
Expected behavior · high confidence
The flagged lines are just icon definitions for the user interface — small SVG drawing instructions with short identifier labels. The scanner mistook those short labels for encoded data, but they are simply internal labels used by the icon library. There is no hidden information here.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal. The match applies to this repository.
Contextual assessment: The code at line 17394 and surrounding context defines Lucide icon components via ht(...) calls, each with SVG path data and short auto-generated React key strings such as key: "1357e3", key: "1vdc57", etc. The scanner's encoded-literal signal is triggered by these short hexadecimal-looking key strings, which are deterministic React keys used to identify SVG child elements. They are not encoded secrets, obfuscated payloads, or encoded commands. This is standard icon-library bundle output with no obfuscation intent or harmful data flow.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.encoded-literal
- File role
- production
- Source
- Asset maid 0.9.2.js:17394
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a temporary access token baked into a screenshot link in a help document, not a real secret key. It only lets the guide display an image and expires on its own.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The matched value is a key query parameter on an image-hosting CDN URL inside an HTML guide document. It is paired with an expires timestamp and only grants time-limited access to a publicly shared screenshot. It is not a model-provider credential, application secret, or user credential, and the file is a static guide rather than executable code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:350
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The regular expressions found here are used to parse image prompt tags and detect image file types, which is exactly what this image-generation plugin needs to do.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The flagged regexes parse weighted-tag prompt syntax and detect image format magic bytes. Patterns for numeric weight delimiters, comma splitting, and gender-word matching are standard for a Danbooru-style tag generator. Nocatastrophic backtracking or user-controlled catastrophic input path is visible in the supplied context. The signal count reflects repeated legitimate parsing patterns across a large bundle.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- generated
- Source
- dist/inlaynexus2.0.js:15
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
This is a test script that loads the plugin's own code to check it starts up correctly. The network calls in the test are fake mock responses, not real internet downloads. This is normal testing practice.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: This is a smoke-test harness that reads the project's own backend source from disk and executes it via vm.runInThisContext to verify it boots and serves requests correctly. The network retrieval is a mocked nativeFetch that returns canned responses. No remote content is fetched and executed; only the local project source is loaded for testing. This is a standard test pattern for a self-contained IIFE plugin.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- reference/smoke.mjs:186-195
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link key for loading a guide screenshot from an image host. It is not a password or account API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The matched value is a CDN URL-signing key parameter in an image src attribute on the Arca.live image CDN. It is a time-limited access token for displaying a documentation screenshot, not a reusable API credential or account secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:264
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link key for loading a guide screenshot from an image host. It is not a password or account API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The matched value is a CDN URL-signing key parameter in an image src attribute on the Arca.live image CDN. It is a time-limited access token for displaying a documentation screenshot, not a reusable API credential or account secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:350
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link key for loading a guide screenshot from an image host. It is not a password or account API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The matched value is a CDN URL-signing key parameter in an image src attribute on the Arca.live image CDN. It is a time-limited access token for displaying a documentation screenshot, not a reusable API credential or account secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:302
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The plugin contacts image-generation and AI-text services, which is exactly what it is supposed to do. There is no evidence that it downloads and runs code from the internet.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner flags co-occurrence of network retrieval and a code execution sink in the same file. The actual network calls use networkFetch to reach NovelAI image-generation endpoints, Google OAuth2 for Vertex AI, and user-configured LLM endpoints. No eval, Function constructor, or vm.runInThisContext appears in the supplied source windows for this file. All network destinations are legitimate provider APIs matching the plugin's stated purpose of LLM tagging and image generation. No untrusted remote content is executed.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- reference/native-backend.js:7-7061
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The regular expressions found are simple text-matching patterns used to categorize image tags. They do not pose a security risk.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The flagged regexes include _FEMALE_RE, _MALE_RE, _PERSON_COUNT_TAG_RE, and the IMAGE_KEY sanitizer. These are simple bounded alternation patterns with word boundaries used for Danbooru-style tag classification and ID sanitization. No catastrophic backtracking or user-controlled regex construction is visible in the supplied code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- reference/native-backend.js:434
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link key for loading a guide screenshot from an image host. It is not a password or account API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The matched value is a CDN URL-signing key parameter in an image src attribute on the Arca.live image CDN. It is a time-limited access token for displaying a documentation screenshot, not a reusable API credential or account secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:245
JavaScript analysis reported javascript.download-to-execution
Expected behavior · medium confidence
The plugin contacts AI and image-generation services as part of its normal job. No evidence was found that it downloads code and runs it.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The bundle contains network fetch calls to well-known LLM and image-generation provider APIs, plus local service addresses for ComfyUI, LM Studio, and Ollama. The scanner flags co-occurrence of a network primitive with an execution sink, but the supplied source shows no download-then-eval or download-then-Function pattern. The likely execution-sink signals are standard runtime constructors and regex exec calls in the bundled code. No attacker-controlled remote code execution path is demonstrated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- generated
- Source
- dist/inlaynexus2.0.js:15-614
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The scanner again saw internet calls and code features together in the same file. The internet calls reach the AI image services the plugin uses, and the code features are part of the React interface framework and image-data parsing. There is no evidence that downloaded data is executed as code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: This is the same download-to-execution correlation on the normalized representation of the same file. The network primitives are calls to image and LLM provider APIs and OAuth token exchanges matching the stated project purpose. The execution sinks are React DOM rendering internals (createElement, createElementNS, innerHTML-based script element creation) and the data-URI image parser Z$ which decodes base64 or percent-encoded data into Uint8Array for image processing. No flow from network-fetched content into eval, new Function, or comparable dynamic code execution is demonstrated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- Asset maid 0.9.2.js:6-4265
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link key for loading a guide screenshot from an image host. It is not a password or account API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The matched value is a CDN URL-signing key parameter in an image src attribute on the Arca.live image CDN. It is a time-limited access token for displaying a documentation screenshot, not a reusable API credential or account secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:333
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link key for loading a guide screenshot from an image host. It is not a password or account API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The matched value is a CDN URL-signing key parameter in an image src attribute on the Arca.live image CDN. It is a time-limited access token for displaying a documentation screenshot, not a reusable API credential or account secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:346
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The scanner flagged a line that simply checks whether an image is embedded as a data URL. This is a test validation step, not a connection to a suspicious website. There is no security concern here.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The JS-X-Ray shady-link signal fires on line 490, which contains a string comparison checking whether an image URL begins with a base64 data URI prefix. This is part of a smoke test harness that mocks all network calls via a local nativeFetch stub. The check asserts that generated image URLs are self-contained data URIs rather than external links. No outbound network request, suspicious destination, or credential flow is present at this location.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- reference/smoke.mjs:490
JavaScript analysis reported javascript.xray.encoded-literal
Expected behavior · high confidence
The scanner found some encoded character sequences, but they are normal parts of regular expressions and standard library code in the bundle. They are not hiding anything malicious.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal. The match applies to this repository.
Contextual assessment: The 3 encoded-literal signals at line 89 correspond to unicode escape sequences inside regex patterns and string constants within the bundled code. These are standard constructs in a minified bundle that includes React DOM internals and CSS parsing utilities. No obfuscated payload or hidden encoded string is present in the supplied source windows.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.encoded-literal
- File role
- production
- Source
- Asset maid 0.9.2.js:89
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
This benchmark script builds the project's own code and runs it in a sandbox to test how fast the gallery listing works. The code it runs is the project's own source, not anything downloaded from the internet. The simulated web requests go to a built-in mock, not to any real server. This is a normal testing tool with no security concern.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: This is a benchmark tool that bundles the project's own source via esbuild and executes the result in a VM context to measure gallery listing performance. The vm.runInThisContext sink operates exclusively on the project's own freshly built output, not on externally retrieved or attacker-controlled data. The fetch call (N.fetch) is a mock router provided by the parity host harness, not a real network primitive; the URL is constructed from hardcoded constants and validated CLI arguments limited to two known routes. There is no untrusted input path into the execution sink and no external network destination.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- tools/bench-gallery.mjs:114-134
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a temporary access token baked into a screenshot link in a help document, not a real secret key. It only lets the guide display an image and expires on its own.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The matched value is a key query parameter on an image-hosting CDN URL inside an HTML guide document. It is paired with an expires timestamp and only grants time-limited access to a publicly shared screenshot. It is not a model-provider credential, application secret, or user credential, and the file is a static guide rather than executable code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:315
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a temporary access token baked into a screenshot link in a help document, not a real secret key. It only lets the guide display an image and expires on its own.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The matched value is a key query parameter on an image-hosting CDN URL inside an HTML guide document. It is paired with an expires timestamp and only grants time-limited access to a publicly shared screenshot. It is not a model-provider credential, application secret, or user credential, and the file is a static guide rather than executable code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:346
Gitleaks reported generic-api-key
Expected behavior · high confidence
The flagged value is a temporary image-viewing key for a screenshot in a guide. It is not an API key or password.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Line 110 contains an img tag with a CDN URL signing key parameter for a screenshot hosted on ac.arca.live. This is a time-limited image access token in a guide HTML file, not a service credential.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:110
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a temporary access token baked into a screenshot link in a help document, not a real secret key. It only lets the guide display an image and expires on its own.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The matched value is a key query parameter on an image-hosting CDN URL inside an HTML guide document. It is paired with an expires timestamp and only grants time-limited access to a publicly shared screenshot. It is not a model-provider credential, application secret, or user credential, and the file is a static guide rather than executable code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:302
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · medium confidence
The scanner flagged some regular expressions in the plugin's interface code as potentially unsafe. The visible patterns are simple text-matching rules for cleaning up HTML and classifying character tags. They do not show the kind of complexity that causes real performance problems. Even if one were slow, the worst case would be a briefly frozen browser tab, not data loss or security breach.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The scanner flagged three unsafe-regex occurrences in the vendored UI bundle. The visible regexes are straightforward content-processing patterns: an HTML tag stripper using simple character-class quantifiers, and gender/person-count classification regexes built from fixed alternations of literal terms. None of the visible patterns exhibit nested or overlapping quantifiers that would cause catastrophic backtracking. Even in a worst-case ReDoS scenario, the impact would be a frozen browser tab on user-supplied text, which is a recoverable local denial of service with low impact. The scanner did not retain matched values, and no concrete exploitable pattern is demonstrated in the supplied evidence.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- vendored
- Source
- vendor/inlay-nexus-ui.js:47
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link key for loading a guide screenshot from an image host. It is not a password or account API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The matched value is a CDN URL-signing key parameter in an image src attribute on the Arca.live image CDN. It is a time-limited access token for displaying a documentation screenshot, not a reusable API credential or account secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:134
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The flagged pattern is in a build configuration file that runs only during development, not in the plugin users install. It's just the build tool reading files and producing the plugin bundle — no risky download-then-execute behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: This candidate flags co-occurrence of network retrieval and code execution in a Vite build configuration file. The file has execution_scope tooling-only and does not ship to end users. The visible source consists of NEEDLE/PATCH string constant pairs used to patch the frozen vendored UI bundle at build time, along with standard Vite plugin configuration. The network retrieval is the build tool reading project files; the code execution is the Vite build process itself. There is no runtime download-and-execute pattern, no dynamic eval of remote content, and no shipped behavior that reaches this code. The correlation is an artifact of the build tooling representation, not a demonstrated runtime threat.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- tooling
- Source
- vite.config.ts:8434-12543
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The flagged code is the normal way a plugin authenticates with Google's Vertex AI service by signing a request and exchanging it for a temporary access token. The rest of the flagged lines are standard React library code for drawing SVG icons and managing web page elements. Nothing here sends data to an unexpected place.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The code at line 5218 performs a standard Google Vertex AI OAuth JWT-bearer token exchange: it signs a JWT using the Web Crypto API with RSASSA-PKCS1-v1_5 and SHA-256, constructs an assertion, and POSTs it to a token endpoint with the standard urn:ietf:params:oauth:grant-type:jwt-bearer grant type. The destination is a Google OAuth token URI. The remaining context windows contain React DOM internals (createElementNS, xlink attribute handling, javascript: URL blocking) and SVG/MathML namespace constants. These are bundled third-party library routines and standard cloud-provider authentication, not suspicious outbound links. The scanner signal is triggered by literal values (likely URLs or OAuth URN strings) that match legitimate provider endpoints. No exfiltration, hidden destinations, or credential theft is demonstrated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- Asset maid 0.9.2.js:5218
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link key for loading a guide screenshot from an image host. It is not a password or account API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The matched value is a CDN URL-signing key parameter in an image src attribute on the Arca.live image CDN. It is a time-limited access token for displaying a documentation screenshot, not a reusable API credential or account secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:315
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link key for loading a guide screenshot from an image host. It is not a password or account API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The matched value is a CDN URL-signing key parameter in an image src attribute on the Arca.live image CDN. It is a time-limited access token for displaying a documentation screenshot, not a reusable API credential or account secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:110
Gitleaks reported generic-api-key
Expected behavior · high confidence
The flagged value is a temporary link key for viewing a screenshot in a guide. It is not a secret credential.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Line 194 contains an img tag with a CDN URL signing key parameter for a screenshot on ac.arca.live. This is a time-limited image access token embedded in a guide page, not a credential.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:194
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The web addresses in the code belong to the image and AI services the plugin is designed to work with. They are not suspicious.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The URLs in this file are NovelAI image-generation and vibe-encoding endpoints, Google OAuth2 token endpoint for Vertex AI, a localhost ComfyUI default, and an OpenRouter referer header. All are legitimate provider endpoints consistent with the plugin's stated purpose and are visible as configurable settings in the default settings object.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- reference/native-backend.js:333
Gitleaks reported generic-api-key
Expected behavior · medium confidence
A secret scanner flagged something on a line of minified code, but the actual code around that line is normal plugin functionality for analyzing character assets. No real credential or secret is visible in the code provided.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The gitleaks generic-api-key rule matched on line 325 of minified production JavaScript, but the matched value was redacted and the surrounding code shows only legitimate plugin logic: asset metadata inspection, image loading, AI analysis orchestration, and debounced config persistence. No hardcoded credential, API key variable, or exfiltration data flow is visible in the supplied source context. The match is a false positive from generic pattern matching against minified identifiers or string literals.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- Asset maid 0.9.2.js:325
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The scanner flagged the code for converting data to JSON format. This is a normal operation the plugin uses to save settings, send requests to AI services, and store image metadata. There is no sign it is copying passwords or environment secrets.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.
Contextual assessment: The serialize-environment signal flags JSON.stringify usage. The code uses JSON.stringify throughout for serializing configuration objects, card metadata, API request bodies, and job state before persisting to local storage or sending to configured LLM and image-generation endpoints. At line 8861 the code validates and stringifies a ComfyUI workflow JSON object. There is no evidence of serializing environment variables, process.env, or credential stores for exfiltration. All JSON.stringify calls operate on plugin-internal data structures or user-configured settings.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.serialize-environment
- File role
- generated
- Source
- dist/inlaynexus2.0.js:8861
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
The code is long and uses complex text-matching patterns, which tripped an automated obfuscation detector. Reading the actual code, everything is in plain, readable form with clear names and comments. There is no hidden or scrambled code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged an obfuscated-code signal at line 1 with low confidence. The supplied source shows a large, fully readable RisuAI TTS plugin with clear constant declarations, named functions, inline SVG strings, and Korean/Japanese localization sets. No minification, encoding, string-array indirection, or concealed logic is present. The signal is a false positive from the file size and complex regex patterns, not genuine obfuscation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- risutts.plugin.js:1
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link key for loading a guide screenshot from an image host. It is not a password or account API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The matched value is a CDN URL-signing key parameter in an image src attribute on the Arca.live image CDN. It is a time-limited access token for displaying a documentation screenshot, not a reusable API credential or account secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:194
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The scanner found web addresses in the code. They are all well-known AI service addresses (OpenAI, Google, Anthropic, etc.) and local addresses for tools the user runs themselves. The plugin needs these to do its job of generating images from text.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The shady-link signal flags URLs in the bundle. The visible URLs are all legitimate and expected for a plugin that calls LLM and image-generation APIs: OpenAI, OpenRouter, Google AI, Anthropic, Voyage AI, Google OAuth token endpoint, localhost addresses for LMStudio, Ollama, and ComfyUI, the project's own GitHub raw URL for plugin updates, and risuai.xyz as an OpenRouter referer header. These match the stated purpose of a plugin that generates images through NovelAI or ComfyUI and uses an LLM for tagging. No undocumented, obfuscated, or suspicious destination is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- dist/inlaynexus2.0.js:700
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a temporary access token baked into a screenshot link in a help document, not a real secret key. It only lets the guide display an image and expires on its own.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The matched value is a key query parameter on an image-hosting CDN URL inside an HTML guide document. It is paired with an expires timestamp and only grants time-limited access to a publicly shared screenshot. It is not a model-provider credential, application secret, or user credential, and the file is a static guide rather than executable code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:264
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link key for loading a guide screenshot from an image host. It is not a password or account API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The matched value is a CDN URL-signing key parameter in an image src attribute on the Arca.live image CDN. It is a time-limited access token for displaying a documentation screenshot, not a reusable API credential or account secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:220
Gitleaks reported generic-api-key
Expected behavior · high confidence
The flagged value is a temporary image-viewing key for a screenshot in a guide. It is not a password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Line 220 contains an img tag with a CDN URL signing key parameter for a screenshot on ac.arca.live. This is a time-limited image access token in a guide HTML file, not an API credential.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:220
Gitleaks reported generic-api-key
Expected behavior · high confidence
The flagged value is a temporary link key for viewing a screenshot in a guide. It is not a secret credential.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Line 155 contains an img tag with a CDN URL signing key parameter for a screenshot on ac.arca.live. This is a time-limited image access token embedded in a guide page, not a service credential.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:155
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The scanner flagged many URLs, but they are standard web namespace identifiers and the image-generation API login endpoint. None are suspicious or hidden destinations.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The 25 shady-link signals correspond to standard namespace URIs such as w3.org SVG and MathML namespaces and legitimate OAuth token endpoint URIs used in the Vertex AI authentication flow. These are static constants in bundled React DOM and authentication code, not dynamic or attacker-controlled destinations. The network calls align with the plugin's stated purpose of calling model-provider image-generation APIs.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- Asset maid 0.9.2.js:16
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The flagged line is part of a test script that loads the project's own backend code to run integration tests. It only executes files that are already part of the project, not anything from users or the internet. This is a normal testing approach, not a security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The matched line uses vm.runInThisContext to load the project's own backend source file (src/native-backend.js) read from the local filesystem via fs.readFileSync. This is a smoke test harness whose stated purpose is to boot the native backend against a mocked RisuAI host. The code being executed is a first-party project source file with a fixed path, not user-supplied, network-sourced, or dynamically constructed input. No attacker-controlled data reaches the vm call. This is a standard pattern for integration-testing a plugin backend outside the browser runtime.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- reference/smoke.mjs:186
Gitleaks reported generic-api-key
Expected behavior · high confidence
The flagged value is a temporary image-viewing key for a screenshot in a guide. It is not a password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Line 207 contains an img tag with a CDN URL signing key parameter for a screenshot on ac.arca.live. This is a time-limited image access token in a guide HTML file, not an API credential.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:207
JavaScript analysis reported javascript.download-to-execution
Expected behavior · medium confidence
The scanner noticed the code both makes web requests and has some code-execution capability somewhere in a very large file. However, the web requests are normal API calls to AI services, and there is no evidence that code downloaded from the internet is being run. The two things appear to be unrelated parts of a large program.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The download-to-execution signal correlates the presence of a network retrieval primitive with a dynamic code or command execution sink in the same file. The file is a 24k-line bundled plugin that makes fetch calls to user-configured LLM and image-generation API endpoints. No evidence is supplied showing a data flow from a network response into an eval, new Function, or similar execution sink. The network calls send prompts and receive JSON or image data; the execution sink likely arises from build-tool runtime code or framework internals in the large bundle. Without a demonstrated path from downloaded content to code execution, this correlation does not establish exposure.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- generated
- Source
- dist/inlaynexus2.0.js:17-24094
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The flagged links are just the default local server addresses a TTS plugin needs to talk to, plus references to the open-source TTS model it uses. This is exactly what a TTS plugin should contain.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The scanner flagged five shady-link occurrences centered on line 31. The visible URLs are localhost endpoints (127.0.0.1:8088 and 127.0.0.1:8090) used as default TTS server addresses, plus header link directives pointing to a GitHub repository and HuggingFace model page for the referenced TTS engine. These are standard, user-visible configuration defaults for a TTS extension that connects to a local server. No hardcoded external exfiltration endpoint is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- risutts.plugin.js:31
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
This smoke test loads the project's own built plugin file and runs it in a sandbox to confirm it starts up and handles basic requests. The code it runs comes from the project's own build output, not from the internet. The test requests are fake ones sent to an internal mock, not to real servers. This is a standard testing tool with no security concern.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: This smoke test reads the project's own built artifact from disk, extracts the backend portion by locating a known vendor UI marker, and executes it in a VM context to verify the bundle boots and serves routes correctly. The vm.runInThisContext sink operates only on the project's own dist output. The fetch calls (N.fetch) are mock requests through the installHost harness, not real HTTP. All request paths and bodies are hardcoded test fixtures. No externally retrieved content reaches the execution sink, and there is no real network destination or attacker-controlled input path.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- tools/smoke.mjs:67-109
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · medium confidence
The scanner flagged the plugin's interface code as looking obfuscated. This is because the code has been compressed by a standard build tool, which shortens variable names and removes formatting to reduce file size. This is normal for production web applications and is not a sign of hidden malicious behavior. The code appears to handle the plugin's user interface and text processing as expected.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged obfuscated-code on the vendored UI bundle. This file is a standard minified Vite build artifact with short variable names and compressed formatting, which is the expected output of a production JavaScript bundler. The project documentation states this is a frozen upstream build whose source is not in the repository. The minified style is consistent with standard build-tool output, not with deliberate concealment. No hidden execution, encoded payloads, or unusual data flows are visible in the supplied evidence; the code performs UI rendering, storage access through the host API, and tag-processing operations consistent with the project's stated purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- vendored
- Source
- vendor/inlay-nexus-ui.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The web addresses found in the code belong to well-known AI services and local tools that the plugin is designed to work with.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged links are endpoints for OpenAI, OpenRouter, Google AI, Anthropic, Vertex AI, Google OAuth, and local services on loopback addresses. All are standard, well-known provider endpoints that match the plugin purpose of calling configurable LLM and image-generation APIs. The signal count reflects the number of supported providers, not suspicious destinations.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- dist/inlaynexus2.0.js:19
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · medium confidence
The code saves its own job and image data using standard JSON conversion. It actually removes sensitive keys before saving, which is a good practice. No evidence of credential theft was found.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.
Contextual assessment: The serialize-environment signal likely fires on the bundler module wrapper and frequent JSON stringify calls that persist job state, card metadata, and settings. The visible code serializes internal application state for IndexedDB storage, not process environment variables or credentials. Several functions explicitly strip API keys and data-URI image payloads before serialization, which is protective rather than exfiltrative. No credential theft data flow is demonstrated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.serialize-environment
- File role
- generated
- Source
- dist/inlaynexus2.0.js:38
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The scanner noticed that the plugin both makes network requests and has code that could theoretically execute dynamic patterns. However, the network calls are just for talking to the TTS server, and the dynamic patterns are used for parsing chat text—not for running code downloaded from the internet. There is no actual connection between downloading data and executing it.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlated a network retrieval primitive with a code execution sink across a 17,000-line span (lines 1047–17170). The visible network primitives are fetch and api.nativeFetch calls that POST voice metadata to a user-configured helper URL or local TTS server—expected behavior for a TTS extension. No eval, Function constructor, innerHTML assignment of fetched content, or similar dynamic code execution sink accepting network-derived data is visible in the supplied evidence. The new RegExp calls in the file construct patterns from escaped local strings for text parsing, not from downloaded content. The broad line range and scanner medium confidence indicate a correlation-based heuristic, not a demonstrated data flow from retrieval to execution.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- risutts.plugin.js:1047-17170
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The scanner flagged text-matching rules in the reformatted code. These are ordinary parsing patterns for handling styling values and image tags, not security threats.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The flagged regexes on the normalized representation are the same standard utility patterns for parsing CSS unit strings, numeric values, and Danbooru-style tag syntax. They are linear-bounded patterns operating on plugin-internal or locally-constructed strings. No catastrophic backtracking risk or attacker-controlled input path is demonstrated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- Asset maid 0.9.2.js:898
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link key for loading a guide screenshot from an image host. It is not a password or account API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The matched value is a CDN URL-signing key parameter in an image src attribute on the Arca.live image CDN. It is a time-limited access token for displaying a documentation screenshot, not a reusable API credential or account secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:155
Gitleaks reported generic-api-key
Expected behavior · high confidence
The flagged value is a temporary link key for viewing a screenshot in a guide. It is not a secret credential.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Line 245 contains an img tag with a CDN URL signing key parameter for a screenshot on ac.arca.live. This is a time-limited image access token embedded in a guide page, not a service credential.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:245
Gitleaks reported generic-api-key
Expected behavior · high confidence
The flagged value is a temporary image-viewing key for a screenshot in a guide. It is not a password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Line 134 contains an img tag with a CDN URL signing key parameter for a screenshot on ac.arca.live. This is a time-limited image access token in a guide HTML file, not an API credential.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:134
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link key for loading a guide screenshot from an image host. It is not a password or account API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The matched value is a CDN URL-signing key parameter in an image src attribute on the Arca.live image CDN. It is a time-limited access token for displaying a documentation screenshot, not a reusable API credential or account secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:167
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The flagged links are the plugin's own local backend address and the official NovelAI image API — exactly what this image-generating plugin is supposed to talk to. Nothing suspicious was found.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The JS-X-Ray shady-link signal flagged fixed URL literals in the vendored UI bundle. The visible source contains two distinct destinations: a localhost backend at 127.0.0.1:28120 (the plugin's own local backend service) and the official NovelAI image generation API endpoint at image.novelai.net. Both destinations are proportionate to the project's stated purpose of generating images through NovelAI or ComfyUI and communicating with its local backend. No third-party, obfuscated, or unexpected external endpoints are present in the supplied evidence. The scanner did not retain matched values, and no exfiltration data flow is visible.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- vendored
- Source
- vendor/inlay-nexus-ui.js:150