JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The extension sends the selected story text to an AI service to write summaries, which is exactly what it advertises. The service address is one the user types in, or one the extension openly says it borrows from its own companion modules when left blank. The text that comes back is treated as plain summary text, never run as code. No evidence shows the fetched data being executed, evaluated, or used to run anything.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlates a network retrieval primitive with a code-execution sink in the same file. The network primitive is a fetch call that posts extraction and summarization prompts to an OpenAI-compatible chat completions endpoint. The destination is the base URL the user configures in this extension's settings, or one explicitly borrowed from sibling module settings when the user leaves the fields blank and the UI discloses that borrowing in both languages. A placeholder is substituted for local endpoints. This matches the extension's stated purpose of summarizing marked chat arcs. The response is parsed as JSON and only the returned message content string is used, after a markdown-stripping regex pass; it is never passed to an evaluator, function constructor, or injected as executable markup. The only dynamic construction visible in the supplied range is a RegExp built from fixed i18n placeholder keys with numeric substitution values, which is not a demonstrated execution sink and has no attacker-controlled input path. The file's other capabilities — hiding messages via the host's is_system flag with prior-state restoration, depth-capped prompt injection, and persistence of ar
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- index.js:273-917