No material or immediate-danger item was identified.
Expected scanner matches (32)
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · low confidence
The scanner noticed a possible link-related pattern in a generated interface bundle, but the supplied evidence does not show an actual destination, request, or data transfer.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: This is a metadata-only static signal with retained literals omitted. The bounded source window shows generated React/runtime code and local browser-state handling, not a confirmed network sink or attacker-controlled URL.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- features/prompts/react/dist/prompt-views.js:6
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This is a regular expression used to recognize narrative scene text while capturing reasoning. It does not access credentials, send data, or execute code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The supplied source shows a bounded, anchored scene-classification expression applied to text for reasoning/narrative detection. No external destination, persistence, dynamic evaluation, or attacker-controlled regex construction is shown. The scanner signal alone does not establish a denial-of-service condition or malicious behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- reasoning/reasoning-capture-core.js:47
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This is a standard web namespace used to identify SVG elements, not a destination for sending data.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged literal is a W3C SVG namespace value used in DOM namespace-selection logic. It does not perform network access or expose user data.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- features/prompts/react/dist/prompt-views.js:1572
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The flagged pattern checks whether a user-entered message-range directive has the expected numeric format. It is a small, bounded validation expression and does not access files, credentials, or external services.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The expression at the cited location is a fixed regular expression applied to rangeStr, which is derived from directive text. It contains only anchored numeric and whitespace matching, with no nested ambiguous quantifiers, unbounded backtracking structure, external effects, or sensitive-data flow. The scanner signal does not indicate a practical denial-of-service condition in this context.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- features/directives/prompt-directives.js:447
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This line is part of the bundled React library's normal handling for namespaced XML attributes. It does not show a connection to an outside service or transmission of user data.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged literal is the standard XML namespace used by React's DOM property metadata for xlink attributes. The supplied context shows attribute registration and DOM assignment behavior, not network access, credential handling, or data exfiltration. The generated file role is consistent with bundled third-party UI code for this extension's interface purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- features/prompts/react/dist/prompt-views.js:1006
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · medium confidence
The flagged pattern is used to recognize directive text while providing autocomplete suggestions. The supplied evidence shows no execution of user-controlled text, network activity, credential handling, or persistence associated with it.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The candidate is a fixed regular expression applied to editor text to parse an optional directive prefix and capture a directive name and value. In the supplied context it is used only for autocomplete branching; no attacker-controlled regex construction, evaluation of matched text, or security-sensitive sink is shown. The expression is bounded by the current line and contains no evident catastrophic-backtracking structure in the supplied snippet.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- features/directives/directive-autocomplete.js:540
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · low confidence
The scanner flagged a regular expression in a bundled JavaScript file, but the available evidence does not show that it can be abused or cause harmful slowdown.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The candidate is a scanner metadata signal without the matched expression or execution path. The supplied context does not establish attacker-controlled input reaching a vulnerable regular expression or a denial-of-service condition.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- generated
- Source
- features/prompts/react/dist/prompt-views.js:9
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This is a standard browser XML namespace used by the bundled UI framework. It is not an external website or a hidden network destination.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The candidate corresponds to the standard XML namespace declaration used when React maps XML attributes. The shown code only creates property metadata and later applies attributes to DOM elements; no request primitive, dynamic destination, or sensitive data flow is present in the supplied context.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- features/prompts/react/dist/prompt-views.js:1001
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The flagged pattern removes emoji and other special characters from prompt names so autocomplete can match them more easily. It does not execute user input or access sensitive data.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The cited expression is a fixed Unicode regular expression applied to the lowercased prompt name during local autocomplete filtering. The supplied context shows no dynamic construction, replacement execution, external destination, persistence, or attacker-controlled regex input; the bounded prompt list and simple character-range matching do not indicate a meaningful security issue.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- features/directives/directive-autocomplete.js:861
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This is a standard web namespace for MathML elements, included by the bundled interface library.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged literal is the standard MathML namespace used by DOM element handling. No request, credential access, or exfiltration is shown.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- features/prompts/react/dist/prompt-views.js:1574
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This regular expression recognizes a narration boundary while parsing roleplay reasoning. The supplied code does not show network access, credential handling, or hidden execution.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The pattern is a fixed, case-insensitive boundary matcher used by strategyMissingSuffix on generated text. It is directly related to the documented reasoning-capture function, and the supplied context shows no attacker-controlled repetition, catastrophic structure, or security-sensitive sink.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- reasoning/reasoning-capture-core.js:400
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This is the ordinary HTML namespace used by browser interface code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The literal is the standard XHTML namespace used for namespace resolution in generated DOM code. It is not a network endpoint or suspicious payload.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- features/prompts/react/dist/prompt-views.js:1576
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · low confidence
The supplied portion is a readable table of prompt names and hover descriptions. The scanner flag alone does not show hidden behavior or harmful activity.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The available source is a static exported object containing descriptive string mappings and comments. No encoded execution, dynamic evaluation, credential access, network destination, persistence, or data transfer is shown in the supplied context. The low-confidence scanner signal is not corroborated by this evidence. This assessment is limited to the supplied file excerpt and candidate metadata.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- features/prompts/prompt-tooltips.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The code inserts interface markup into an SVG-related DOM element, which is normal browser rendering behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged namespace check precedes DOM innerHTML handling in bundled rendering logic. The supplied context shows no external destination or sensitive-data flow.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- features/prompts/react/dist/prompt-views.js:1600
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · low confidence
The available code context shows a normal user-interface component for displaying directive conflicts and resolving them. The scanner reported a possible obfuscation signal, but did not provide the matched text, and the supplied context does not show concealed execution or suspicious data handling.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The candidate is based solely on a low-confidence static obfuscation heuristic with retained literals unavailable. Supplied source context contains readable imports, DOM queries, validation filtering, and user-resolution callbacks consistent with the stated prompt-directive UI purpose. No evidence here establishes hidden payloads, credential access, exfiltration, persistence, or harmful execution timing.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- features/directives/directive-ui.js:1
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This pattern detects a normal reasoning-to-narration transition used by the extension's parser. Nothing supplied indicates malicious behavior or a meaningful security impact.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The fixed regular expression is applied to parser input to locate an explicit closing marker. Its use is proportional to the documented reasoning-capture purpose; the available code does not establish unsafe complexity or a denial-of-service path.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- reasoning/reasoning-capture-core.js:397
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This is a standard namespace conversion used when browser code moves content between SVG and HTML.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The literal is used for SVG foreign-object namespace handling in generated UI-library code. It does not establish communication with a remote service.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- features/prompts/react/dist/prompt-views.js:1583
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This pattern recognizes a supported template boundary in reasoning output. It is ordinary parsing logic for the stated extension purpose.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The matcher is a simple fixed boundary expression used in strategyMissingSuffix against generated text. No security-sensitive destination, persistence, credential flow, or demonstrable catastrophic backtracking is shown in the supplied context.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- reasoning/reasoning-capture-core.js:396
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The flagged text is ordinary browser rendering code from a bundled UI library. It creates standard HTML elements and handles script elements; the supplied context does not show a suspicious link or external communication.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The cited code is generated React/DOM reconciliation logic. The relevant operations create elements through document APIs and assign properties; no destination, credential access, persistence, or network request is shown. The scanner signal is therefore consistent with a false positive or benign framework code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- features/prompts/react/dist/prompt-views.js:7880
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · low confidence
This is another link-related scanner signal in generated code. The supplied material does not identify a suspicious link or show information being sent anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: Only the rule classification and source location are supplied; matched literals were withheld. The visible code is primarily React DOM rendering and localStorage state persistence, insufficient to infer malicious network behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- features/prompts/react/dist/prompt-views.js:9
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · medium confidence
The flagged file is a generated JavaScript bundle, and the available excerpt shows ordinary bundled-module and React runtime helpers rather than hidden behavior. The scanner signal alone does not establish harmful activity.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The candidate is a low-confidence obfuscation signal on an auto-generated distribution artifact. The supplied context contains standard minified/bundler-style aliases, module wrappers, property helpers, and React symbols. No destination, credential access, concealed execution, persistence, or malicious update flow is shown. The provided evidence is limited to the beginning of a large generated file, so this assessment does not establish behavior in the unshown remainder.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- generated
- Source
- features/prompts/react/dist/prompt-views.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This is a built-in browser namespace value used by the bundled rendering code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged value is consumed by namespace-selection logic in a generated JavaScript bundle. No fetch, socket, credential handling, or data transmission is evidenced.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- features/prompts/react/dist/prompt-views.js:1580
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The flagged code is test-only logic that loads the directive parser, removes module syntax, and runs it in an isolated virtual-machine context to test parsing behavior. The supplied evidence does not show execution of user-controlled code or access to external systems.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The dynamic Script construction occurs in tests/directives-runtime.test.js. Its input is assembled from a repository source file, and runInNewContext receives a narrowly defined test context containing inert logging, a null manager, and an empty context provider. This supports runtime testing rather than production dynamic execution; no attacker-controlled input, persistence, credential access, or network destination is shown in the supplied evidence.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/directives-runtime.test.js:23-27
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The flagged text is a standard browser namespace identifier used when creating HTML elements. It is not evidence that the extension opens a shady website or sends data anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The cited literal is the standard XHTML namespace used by generated DOM rendering code. The surrounding logic selects element-creation paths and does not establish an external destination or transmit data. No security-relevant behavior is demonstrated by this candidate.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- features/prompts/react/dist/prompt-views.js:7877
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · low confidence
The available excerpt shows ordinary directive definitions and an autocomplete-related import. It does not show hidden execution, credential access, or data transmission. The scanner signal is not substantiated by the supplied source.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The candidate is a low-confidence static obfuscation signal, but the supplied representation contains only a small source excerpt and does not retain matched literals. The visible code is consistent with documented prompt-directive autocomplete functionality; no suspicious data flow or execution is demonstrated.
Impact: none · Exploitability: unlikely
Developer action: Provide the complete JavaScript representation or the scanner's matched region so the reported obfuscation signal can be validated.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- features/directives/directive-autocomplete.js:1
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This is a regular expression used to recognize fenced code blocks while formatting documentation for display. The supplied code does not show attacker-controlled data reaching a dangerous external action.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged expression processes escaped documentation text in a local markdown-to-HTML formatter. It is fixed, bounded by a closing fence, and used only for presentation. Although backtracking behavior cannot be fully ruled out from the scanner signal alone, the evidence shows no credential access, network transmission, persistence, or security-boundary bypass associated with it.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- features/directives/directive-ui.js:490
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The flagged pattern only examines a section name to separate leading emoji from the rest of the label. It does not handle secrets, make network requests, or execute code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The fixed, anchored Unicode character-class expression is applied to e.name in a memoized UI-rendering path. Its purpose is presentation formatting, with no attacker-controlled execution or security-sensitive data flow evident in the supplied context.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- generated
- Source
- features/prompts/react/dist/prompt-views.js:12540
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · low confidence
The scanner reported a possible link pattern in the generated bundle, but no concrete link, destination, or data flow is available for review.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: This remains an unconfirmed static signal. The evidence does not provide the matched literal or demonstrate execution timing, external destination, credential access, or exfiltration.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- features/prompts/react/dist/prompt-views.js:2
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This line defines the standard XML namespace for ordinary XML attributes in React's bundled code. It does not indicate suspicious communication or persistence.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The fixed namespace is the standard XML namespace identifier used by React's attribute handling. Its use is limited to DOM namespace-aware attribute operations in generated framework code, with no evidence here of outbound communication, credential access, or concealed execution.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- features/prompts/react/dist/prompt-views.js:997
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This is a regular expression used to identify dialogue-like narrative text. It does not communicate with outside services or handle secrets.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The supplied source shows an anchored dialogue-detection expression with a bounded quoted-content repetition and Unicode character classes, used by narrative-start classification. It is consistent with the extension's reasoning-capture purpose; no dangerous data flow or execution behavior is evidenced.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- reasoning/reasoning-capture-core.js:46
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This is ordinary SVG-to-HTML rendering support from a generated interface bundle.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The literal is part of standard DOM namespace handling around SVG foreignObject content. The surrounding code only selects namespaces and updates DOM nodes; it shows no suspicious external data flow.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- features/prompts/react/dist/prompt-views.js:1582
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · low confidence
The available excerpt shows ordinary interface setup for a prompt archive. The scanner reported a possible obfuscation signal, but the matched values and the relevant remainder of the file were not provided, so this evidence does not show hidden harmful behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The supplied source excerpt contains readable imports, DOM queries, interval polling, element creation, and initialization logic consistent with the documented prompt-archive UI purpose. No concealed execution, credential access, external destination, or suspicious persistence is shown. The low-confidence obfuscation metadata is insufficient by itself to establish malicious behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- features/prompts/prompt-archive-ui.js:1