The flagged line executes JavaScript, but the code comes from scripts the user writes and saves in the extension's settings. The AI cannot provide its own code to run; it can only trigger scripts the user already configured. This is the extension's intended purpose, clearly described in its documentation.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The OpenGrep rule flags `Function(javascript)()` at line 103 as dynamic JavaScript execution. Tracing the data flow: `runJavaScript` is called from `runScript` (line 120) with `script.javascript`, where `script` is an object from `enabledScripts` — a filtered subset of `settings.scripts`. These script objects are created and edited by the user through the extension UI (lines 241-290), with the JavaScript field populated via textarea input (lines 283-286). The AI model's only contribution is emitting markers containing a numeric script ID (line 137), which selects which pre-configured script to run. No model-generated text is passed to `Function()`. This dynamic execution is the explicitly stated purpose of the extension (binding user-written code to model-triggered events) and is fully disclosed in the README.
This extension is designed to run JavaScript code that the user writes and configures. The code being executed is the user's own, entered through the extension's settings UI. The AI model can only choose which pre-written script to trigger, not supply new code. This is the extension's intended feature.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-stmt. The match applies to this repository.
Contextual assessment: The scanner flags line 103 (`Function(javascript)()`) as dynamic execution. However, the `javascript` argument originates entirely from user-authored scripts stored in extension settings (populated via the settings UI at lines 283-286 and 288-290). The AI model does not supply JavaScript code; it only emits markers containing a script ID (parsed at line 137), which selects a pre-configured script object from `enabledScripts`. The model's output never reaches `runJavaScript` as a code string. This is the core, stated functionality of the extension: executing user-written code in response to model-emitted event markers. The capability is disclosed in the README and visible in the UI.