TavernKeeper Scan Report

NemoVonNirgend/NemoPresetExt

Commit 9ab4153 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 35 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

zizmor reported unpinned-uses

Minor caution · high confidence

The workflow uses a movable version label for a third-party build action. If that label were changed maliciously, future workflow runs could execute unintended code.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The scanner identifies an unpinned GitHub Actions reference in a validation workflow. The job has read-only repository permissions and no supplied evidence shows secrets or attacker-controlled workflow inputs, so this is supply-chain hardening rather than demonstrated compromise.

Impact: medium · Exploitability: plausible

Developer action: Pin the referenced action to a full commit SHA and update it deliberately when upgrading.

Scanner
zizmor 1.28.0
Rule
unpinned-uses
File role
tooling
Source
.github/workflows/prompt-workstation-ci.yml:20

zizmor reported unpinned-uses

Minor caution · high confidence

The workflow uses a movable version label for a third-party build action. A changed label could make later builds run different code than intended.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The scanner identifies an unpinned GitHub Actions reference in the workflow. Available context shows repository contents are read-only and does not demonstrate secret exposure or malicious behavior.

Impact: medium · Exploitability: plausible

Developer action: Pin the referenced action to a full commit SHA and update it deliberately when upgrading.

Scanner
zizmor 1.28.0
Rule
unpinned-uses
File role
tooling
Source
.github/workflows/prompt-workstation-ci.yml:16

zizmor reported artipacked

Minor caution · low confidence

The scan suggests the workflow may save files from its temporary build environment. If sensitive files are included, they could remain downloadable as build artifacts.

Technical evidence

Scanner reason: zizmor matched workflow-security rule artipacked in this repository.

Contextual assessment: The low-confidence scanner candidate indicates possible credential persistence through workflow artifacts, but the relevant workflow excerpts and artifact paths are not supplied. The available context does not establish that credentials are created, present, or uploaded.

Impact: medium · Exploitability: plausible

Developer action: Review the complete workflow and artifact configuration; avoid uploading broad workspace contents, and exclude credential-bearing files or disable artifact retention where unnecessary.

Scanner
zizmor 1.28.0
Rule
artipacked
File role
tooling
Source
.github/workflows/prompt-workstation-ci.yml:16-18
Expected scanner matches (32)

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · low confidence

The scanner noticed a possible link-related pattern in a generated interface bundle, but the supplied evidence does not show an actual destination, request, or data transfer.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: This is a metadata-only static signal with retained literals omitted. The bounded source window shows generated React/runtime code and local browser-state handling, not a confirmed network sink or attacker-controlled URL.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
generated
Source
features/prompts/react/dist/prompt-views.js:6

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This is a regular expression used to recognize narrative scene text while capturing reasoning. It does not access credentials, send data, or execute code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The supplied source shows a bounded, anchored scene-classification expression applied to text for reasoning/narrative detection. No external destination, persistence, dynamic evaluation, or attacker-controlled regex construction is shown. The scanner signal alone does not establish a denial-of-service condition or malicious behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
reasoning/reasoning-capture-core.js:47

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a standard web namespace used to identify SVG elements, not a destination for sending data.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The flagged literal is a W3C SVG namespace value used in DOM namespace-selection logic. It does not perform network access or expose user data.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
generated
Source
features/prompts/react/dist/prompt-views.js:1572

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The flagged pattern checks whether a user-entered message-range directive has the expected numeric format. It is a small, bounded validation expression and does not access files, credentials, or external services.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The expression at the cited location is a fixed regular expression applied to rangeStr, which is derived from directive text. It contains only anchored numeric and whitespace matching, with no nested ambiguous quantifiers, unbounded backtracking structure, external effects, or sensitive-data flow. The scanner signal does not indicate a practical denial-of-service condition in this context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
features/directives/prompt-directives.js:447

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This line is part of the bundled React library's normal handling for namespaced XML attributes. It does not show a connection to an outside service or transmission of user data.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The flagged literal is the standard XML namespace used by React's DOM property metadata for xlink attributes. The supplied context shows attribute registration and DOM assignment behavior, not network access, credential handling, or data exfiltration. The generated file role is consistent with bundled third-party UI code for this extension's interface purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
generated
Source
features/prompts/react/dist/prompt-views.js:1006

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · medium confidence

The flagged pattern is used to recognize directive text while providing autocomplete suggestions. The supplied evidence shows no execution of user-controlled text, network activity, credential handling, or persistence associated with it.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The candidate is a fixed regular expression applied to editor text to parse an optional directive prefix and capture a directive name and value. In the supplied context it is used only for autocomplete branching; no attacker-controlled regex construction, evaluation of matched text, or security-sensitive sink is shown. The expression is bounded by the current line and contains no evident catastrophic-backtracking structure in the supplied snippet.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
features/directives/directive-autocomplete.js:540

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · low confidence

The scanner flagged a regular expression in a bundled JavaScript file, but the available evidence does not show that it can be abused or cause harmful slowdown.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The candidate is a scanner metadata signal without the matched expression or execution path. The supplied context does not establish attacker-controlled input reaching a vulnerable regular expression or a denial-of-service condition.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
generated
Source
features/prompts/react/dist/prompt-views.js:9

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a standard browser XML namespace used by the bundled UI framework. It is not an external website or a hidden network destination.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The candidate corresponds to the standard XML namespace declaration used when React maps XML attributes. The shown code only creates property metadata and later applies attributes to DOM elements; no request primitive, dynamic destination, or sensitive data flow is present in the supplied context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
generated
Source
features/prompts/react/dist/prompt-views.js:1001

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The flagged pattern removes emoji and other special characters from prompt names so autocomplete can match them more easily. It does not execute user input or access sensitive data.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The cited expression is a fixed Unicode regular expression applied to the lowercased prompt name during local autocomplete filtering. The supplied context shows no dynamic construction, replacement execution, external destination, persistence, or attacker-controlled regex input; the bounded prompt list and simple character-range matching do not indicate a meaningful security issue.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
features/directives/directive-autocomplete.js:861

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a standard web namespace for MathML elements, included by the bundled interface library.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The flagged literal is the standard MathML namespace used by DOM element handling. No request, credential access, or exfiltration is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
generated
Source
features/prompts/react/dist/prompt-views.js:1574

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This regular expression recognizes a narration boundary while parsing roleplay reasoning. The supplied code does not show network access, credential handling, or hidden execution.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The pattern is a fixed, case-insensitive boundary matcher used by strategyMissingSuffix on generated text. It is directly related to the documented reasoning-capture function, and the supplied context shows no attacker-controlled repetition, catastrophic structure, or security-sensitive sink.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
reasoning/reasoning-capture-core.js:400

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is the ordinary HTML namespace used by browser interface code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The literal is the standard XHTML namespace used for namespace resolution in generated DOM code. It is not a network endpoint or suspicious payload.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
generated
Source
features/prompts/react/dist/prompt-views.js:1576

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · low confidence

The supplied portion is a readable table of prompt names and hover descriptions. The scanner flag alone does not show hidden behavior or harmful activity.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.

Contextual assessment: The available source is a static exported object containing descriptive string mappings and comments. No encoded execution, dynamic evaluation, credential access, network destination, persistence, or data transfer is shown in the supplied context. The low-confidence scanner signal is not corroborated by this evidence. This assessment is limited to the supplied file excerpt and candidate metadata.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
features/prompts/prompt-tooltips.js:1

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The code inserts interface markup into an SVG-related DOM element, which is normal browser rendering behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The flagged namespace check precedes DOM innerHTML handling in bundled rendering logic. The supplied context shows no external destination or sensitive-data flow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
generated
Source
features/prompts/react/dist/prompt-views.js:1600

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · low confidence

The available code context shows a normal user-interface component for displaying directive conflicts and resolving them. The scanner reported a possible obfuscation signal, but did not provide the matched text, and the supplied context does not show concealed execution or suspicious data handling.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.

Contextual assessment: The candidate is based solely on a low-confidence static obfuscation heuristic with retained literals unavailable. Supplied source context contains readable imports, DOM queries, validation filtering, and user-resolution callbacks consistent with the stated prompt-directive UI purpose. No evidence here establishes hidden payloads, credential access, exfiltration, persistence, or harmful execution timing.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
features/directives/directive-ui.js:1

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This pattern detects a normal reasoning-to-narration transition used by the extension's parser. Nothing supplied indicates malicious behavior or a meaningful security impact.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The fixed regular expression is applied to parser input to locate an explicit closing marker. Its use is proportional to the documented reasoning-capture purpose; the available code does not establish unsafe complexity or a denial-of-service path.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
reasoning/reasoning-capture-core.js:397

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a standard namespace conversion used when browser code moves content between SVG and HTML.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The literal is used for SVG foreign-object namespace handling in generated UI-library code. It does not establish communication with a remote service.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
generated
Source
features/prompts/react/dist/prompt-views.js:1583

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This pattern recognizes a supported template boundary in reasoning output. It is ordinary parsing logic for the stated extension purpose.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The matcher is a simple fixed boundary expression used in strategyMissingSuffix against generated text. No security-sensitive destination, persistence, credential flow, or demonstrable catastrophic backtracking is shown in the supplied context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
reasoning/reasoning-capture-core.js:396

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged text is ordinary browser rendering code from a bundled UI library. It creates standard HTML elements and handles script elements; the supplied context does not show a suspicious link or external communication.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The cited code is generated React/DOM reconciliation logic. The relevant operations create elements through document APIs and assign properties; no destination, credential access, persistence, or network request is shown. The scanner signal is therefore consistent with a false positive or benign framework code.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
generated
Source
features/prompts/react/dist/prompt-views.js:7880

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · low confidence

This is another link-related scanner signal in generated code. The supplied material does not identify a suspicious link or show information being sent anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: Only the rule classification and source location are supplied; matched literals were withheld. The visible code is primarily React DOM rendering and localStorage state persistence, insufficient to infer malicious network behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
generated
Source
features/prompts/react/dist/prompt-views.js:9

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · medium confidence

The flagged file is a generated JavaScript bundle, and the available excerpt shows ordinary bundled-module and React runtime helpers rather than hidden behavior. The scanner signal alone does not establish harmful activity.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.

Contextual assessment: The candidate is a low-confidence obfuscation signal on an auto-generated distribution artifact. The supplied context contains standard minified/bundler-style aliases, module wrappers, property helpers, and React symbols. No destination, credential access, concealed execution, persistence, or malicious update flow is shown. The provided evidence is limited to the beginning of a large generated file, so this assessment does not establish behavior in the unshown remainder.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.obfuscated-code
File role
generated
Source
features/prompts/react/dist/prompt-views.js:1

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a built-in browser namespace value used by the bundled rendering code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The flagged value is consumed by namespace-selection logic in a generated JavaScript bundle. No fetch, socket, credential handling, or data transmission is evidenced.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
generated
Source
features/prompts/react/dist/prompt-views.js:1580

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

The flagged code is test-only logic that loads the directive parser, removes module syntax, and runs it in an isolated virtual-machine context to test parsing behavior. The supplied evidence does not show execution of user-controlled code or access to external systems.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The dynamic Script construction occurs in tests/directives-runtime.test.js. Its input is assembled from a repository source file, and runInNewContext receives a narrowly defined test context containing inert logging, a null manager, and an empty context provider. This supports runtime testing rather than production dynamic execution; no attacker-controlled input, persistence, credential access, or network destination is shown in the supplied evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
test
Source
tests/directives-runtime.test.js:23-27

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged text is a standard browser namespace identifier used when creating HTML elements. It is not evidence that the extension opens a shady website or sends data anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The cited literal is the standard XHTML namespace used by generated DOM rendering code. The surrounding logic selects element-creation paths and does not establish an external destination or transmit data. No security-relevant behavior is demonstrated by this candidate.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
generated
Source
features/prompts/react/dist/prompt-views.js:7877

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · low confidence

The available excerpt shows ordinary directive definitions and an autocomplete-related import. It does not show hidden execution, credential access, or data transmission. The scanner signal is not substantiated by the supplied source.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.

Contextual assessment: The candidate is a low-confidence static obfuscation signal, but the supplied representation contains only a small source excerpt and does not retain matched literals. The visible code is consistent with documented prompt-directive autocomplete functionality; no suspicious data flow or execution is demonstrated.

Impact: none · Exploitability: unlikely

Developer action: Provide the complete JavaScript representation or the scanner's matched region so the reported obfuscation signal can be validated.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
features/directives/directive-autocomplete.js:1

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This is a regular expression used to recognize fenced code blocks while formatting documentation for display. The supplied code does not show attacker-controlled data reaching a dangerous external action.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The flagged expression processes escaped documentation text in a local markdown-to-HTML formatter. It is fixed, bounded by a closing fence, and used only for presentation. Although backtracking behavior cannot be fully ruled out from the scanner signal alone, the evidence shows no credential access, network transmission, persistence, or security-boundary bypass associated with it.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
features/directives/directive-ui.js:490

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The flagged pattern only examines a section name to separate leading emoji from the rest of the label. It does not handle secrets, make network requests, or execute code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The fixed, anchored Unicode character-class expression is applied to e.name in a memoized UI-rendering path. Its purpose is presentation formatting, with no attacker-controlled execution or security-sensitive data flow evident in the supplied context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
generated
Source
features/prompts/react/dist/prompt-views.js:12540

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · low confidence

The scanner reported a possible link pattern in the generated bundle, but no concrete link, destination, or data flow is available for review.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: This remains an unconfirmed static signal. The evidence does not provide the matched literal or demonstrate execution timing, external destination, credential access, or exfiltration.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
generated
Source
features/prompts/react/dist/prompt-views.js:2

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This line defines the standard XML namespace for ordinary XML attributes in React's bundled code. It does not indicate suspicious communication or persistence.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The fixed namespace is the standard XML namespace identifier used by React's attribute handling. Its use is limited to DOM namespace-aware attribute operations in generated framework code, with no evidence here of outbound communication, credential access, or concealed execution.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
generated
Source
features/prompts/react/dist/prompt-views.js:997

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This is a regular expression used to identify dialogue-like narrative text. It does not communicate with outside services or handle secrets.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The supplied source shows an anchored dialogue-detection expression with a bounded quoted-content repetition and Unicode character classes, used by narrative-start classification. It is consistent with the extension's reasoning-capture purpose; no dangerous data flow or execution behavior is evidenced.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
reasoning/reasoning-capture-core.js:46

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is ordinary SVG-to-HTML rendering support from a generated interface bundle.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The literal is part of standard DOM namespace handling around SVG foreignObject content. The surrounding code only selects namespaces and updates DOM nodes; it shows no suspicious external data flow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
generated
Source
features/prompts/react/dist/prompt-views.js:1582

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · low confidence

The available excerpt shows ordinary interface setup for a prompt archive. The scanner reported a possible obfuscation signal, but the matched values and the relevant remainder of the file were not provided, so this evidence does not show hidden harmful behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.

Contextual assessment: The supplied source excerpt contains readable imports, DOM queries, interval polling, element creation, and initialization logic consistent with the documented prompt-archive UI purpose. No concealed execution, credential access, external destination, or suspicious persistence is shown. The low-confidence obfuscation metadata is insufficient by itself to establish malicious behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
features/prompts/prompt-archive-ui.js:1

Coverage and limitations

JavaScript coverage

Unresolved JavaScript stages

Tools

Limitations

Technical scan identity