The scanner saw text shaped like a web address and flagged it, but it is just the official label browsers require when creating the drawing elements for the skill tree picture. This code never contacts that address or any server.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged string is the standard W3C SVG namespace identifier, declared as a constant and used solely as the namespace argument to the DOM createElementNS API when the skill tree popup draws its connector lines and node graphics. It is an identifier literal required by the platform, not a network endpoint; the module contains no request, fetch, or connection logic and the surrounding code is pure interface rendering and local state manipulation. The link heuristic is a false positive on a well-known namespace URI.
The scanner flagged this file as possibly containing disguised or scrambled code, but it is just a readable list of starting game numbers like health and mana for new characters. There is nothing hidden in it.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.