{"data":{"skill":{"slug":"qingyuna-answer-me-with-html","name":"answer-me-with-html","icon":"📦","repo":"https://github.com/qingyuna/answer-me-with-html/tree/0f2e0f18280b29c875b56a5f41253ee49c4b7956/skills/answer-me-with-html","status":"approved","author":"qingyuna","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"ae199c09-b907-4644-98e6-1c69f104c980","skill_id":"2be7b216-905b-4f9e-b607-ae11230ba034","version":1,"content_hash":"v3:747cc4a202a58444d48f42de73cfce79288af501:02aa9484b130d0d1592cfab38fb145cd59a0aea8ae9435aa144125dcd389e1a4:5c89427a7b18ae2b2e07b01a09c3308414a79e555890d7e609da295e0a5e0084:736b696c6c732f71696e6779756e612f616e737765722d6d652d776974682d68746d6c:23a2d3611e26095cf926e47989969a87","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"Most supplied matches concern embedded assets, parser syntax, or secret-blocking checks; no evidence found of destructive intent or audit-targeted prompt injection. Speech transport, implicit cloud narration, and optional plaintext LAN sharing create credential and privacy risks. All 400 supplied findings are adjudicated; 1,812 unpresented matches still require manual review before automatic publication. Static review was capped at 400/2212 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.","remediation":[{"issue":"Static review capped","severity":"medium","suggestion":"Manually review the omitted 1812 static analyzer matches or reduce bundled generated/vendor/reference content before enabling automatic publication."},{"issue":"Configured speech requests can send credentials and narration over remote plaintext HTTP.","severity":"high","suggestion":"Require HTTPS for non-loopback speech endpoints, reject URL credentials, and revalidate redirects before forwarding authorization headers."},{"issue":"Automatic voice selection treats an existing ElevenLabs key as permission to upload narration.","severity":"medium","suggestion":"Default to system speech or subtitles. Require an explicit provider choice before sending narration to a cloud service."},{"issue":"Optional LAN sharing exposes bearer capability links over plaintext HTTP on every IPv4 interface.","severity":"medium","suggestion":"Retain loopback defaults and require explicit sharing consent. Prefer a selected interface with HTTPS or a trusted encrypted tunnel."},{"issue":"The static analyzer presented only 400 of 2,212 matches.","severity":"high","suggestion":"Review the remaining 1,812 matches and verify bundled dependency provenance before enabling automatic publication."}],"risk_factor_evidence":[{"factor":"filesystem","evidence":[{"file":"references/settings.md","line_end":19,"line_start":19},{"file":"references/settings.md","line_end":19,"line_start":19},{"file":"references/video.md","line_end":3,"line_start":3},{"file":"references/video.md","line_end":35,"line_start":35},{"file":"references/video.md","line_end":35,"line_start":35},{"file":"scripts/am.mjs","line_end":33,"line_start":33},{"file":"scripts/am.mjs","line_end":2065,"line_start":2065},{"file":"scripts/am.mjs","line_end":2409,"line_start":2409},{"file":"scripts/am.mjs","line_end":9155,"line_start":9155},{"file":"scripts/am.mjs","line_end":9161,"line_start":9161},{"file":"scripts/am.mjs","line_end":9341,"line_start":9341},{"file":"scripts/am.mjs","line_end":9490,"line_start":9490},{"file":"scripts/am.mjs","line_end":9847,"line_start":9847},{"file":"scripts/am.mjs","line_end":9946,"line_start":9946},{"file":"scripts/am.mjs","line_end":9973,"line_start":9973},{"file":"scripts/am.mjs","line_end":9991,"line_start":9991},{"file":"scripts/am.mjs","line_end":9995,"line_start":9995},{"file":"scripts/am.mjs","line_end":10001,"line_start":10001},{"file":"scripts/am.mjs","line_end":10011,"line_start":10011},{"file":"scripts/am.mjs","line_end":10169,"line_start":10169},{"file":"scripts/am.mjs","line_end":10183,"line_start":10183},{"file":"scripts/am.mjs","line_end":10507,"line_start":10507},{"file":"scripts/am.mjs","line_end":10682,"line_start":10682},{"file":"scripts/am.mjs","line_end":10698,"line_start":10698},{"file":"scripts/am.mjs","line_end":10765,"line_start":10765},{"file":"scripts/am.mjs","line_end":10850,"line_start":10850},{"file":"scripts/am.mjs","line_end":10861,"line_start":10861},{"file":"scripts/am.mjs","line_end":11057,"line_start":11057},{"file":"scripts/am.mjs","line_end":11157,"line_start":11157},{"file":"scripts/am.mjs","line_end":11247,"line_start":11247},{"file":"scripts/am.mjs","line_end":11565,"line_start":11565},{"file":"scripts/am.mjs","line_end":11670,"line_start":11670},{"file":"scripts/am.mjs","line_end":11682,"line_start":11682},{"file":"scripts/am.mjs","line_end":11730,"line_start":11730},{"file":"scripts/am.mjs","line_end":11756,"line_start":11756},{"file":"scripts/am.mjs","line_end":11765,"line_start":11765},{"file":"scripts/am.mjs","line_end":12279,"line_start":12279},{"file":"scripts/am.mjs","line_end":12361,"line_start":12361},{"file":"scripts/am.mjs","line_end":12477,"line_start":12477},{"file":"scripts/am.mjs","line_end":12491,"line_start":12491},{"file":"scripts/am.mjs","line_end":12635,"line_start":12635},{"file":"scripts/am.mjs","line_end":12638,"line_start":12638},{"file":"scripts/am.mjs","line_end":639,"line_start":639},{"file":"scripts/am.mjs","line_end":7327,"line_start":7327},{"file":"scripts/am.mjs","line_end":7613,"line_start":7613},{"file":"scripts/am.mjs","line_end":12048,"line_start":12048},{"file":"scripts/am.mjs","line_end":12182,"line_start":12182},{"file":"scripts/am.mjs","line_end":12415,"line_start":12415},{"file":"scripts/am.mjs","line_end":12424,"line_start":12424},{"file":"scripts/am.mjs","line_end":27,"line_start":27}]},{"factor":"env_access","evidence":[{"file":"references/video.md","line_end":34,"line_start":34},{"file":"scripts/am.mjs","line_end":9909,"line_start":9909},{"file":"scripts/am.mjs","line_end":9912,"line_start":9912},{"file":"scripts/am.mjs","line_end":9952,"line_start":9952},{"file":"scripts/am.mjs","line_end":9976,"line_start":9976},{"file":"scripts/am.mjs","line_end":9982,"line_start":9982},{"file":"scripts/am.mjs","line_end":10040,"line_start":10040},{"file":"scripts/am.mjs","line_end":10104,"line_start":10104},{"file":"scripts/am.mjs","line_end":11084,"line_start":11084},{"file":"scripts/am.mjs","line_end":11149,"line_start":11149},{"file":"scripts/am.mjs","line_end":11222,"line_start":11222},{"file":"scripts/am.mjs","line_end":11391,"line_start":11391},{"file":"scripts/am.mjs","line_end":11605,"line_start":11605},{"file":"scripts/am.mjs","line_end":12191,"line_start":12191},{"file":"scripts/am.mjs","line_end":9905,"line_start":9905},{"file":"scripts/am.mjs","line_end":10552,"line_start":10552},{"file":"scripts/am.mjs","line_end":10561,"line_start":10561},{"file":"scripts/am.mjs","line_end":10580,"line_start":10580},{"file":"scripts/am.mjs","line_end":10612,"line_start":10612},{"file":"scripts/am.mjs","line_end":12171,"line_start":12171},{"file":"scripts/am.mjs","line_end":12178,"line_start":12178}]},{"factor":"scripts","evidence":[{"file":"scripts/am.mjs","line_end":639,"line_start":639},{"file":"scripts/am.mjs","line_end":10520,"line_start":10520},{"file":"scripts/am.mjs","line_end":639,"line_start":639},{"file":"scripts/am.mjs","line_end":1355,"line_start":1355},{"file":"scripts/am.mjs","line_end":27,"line_start":27},{"file":"scripts/am.mjs","line_end":27,"line_start":27},{"file":"scripts/am.mjs","line_end":27,"line_start":27},{"file":"scripts/am.mjs","line_end":1146,"line_start":1146},{"file":"scripts/am.mjs","line_end":2694,"line_start":2694},{"file":"scripts/am.mjs","line_end":2701,"line_start":2701},{"file":"scripts/am.mjs","line_end":2717,"line_start":2717},{"file":"scripts/am.mjs","line_end":2721,"line_start":2721},{"file":"scripts/am.mjs","line_end":2728,"line_start":2728},{"file":"scripts/am.mjs","line_end":2735,"line_start":2735},{"file":"scripts/am.mjs","line_end":2747,"line_start":2747},{"file":"scripts/am.mjs","line_end":2752,"line_start":2752},{"file":"scripts/am.mjs","line_end":2797,"line_start":2797},{"file":"scripts/am.mjs","line_end":2804,"line_start":2804},{"file":"scripts/am.mjs","line_end":2845,"line_start":2845},{"file":"scripts/am.mjs","line_end":2860,"line_start":2860},{"file":"scripts/am.mjs","line_end":2867,"line_start":2867},{"file":"scripts/am.mjs","line_end":2875,"line_start":2875},{"file":"scripts/am.mjs","line_end":2888,"line_start":2888},{"file":"scripts/am.mjs","line_end":2896,"line_start":2896},{"file":"scripts/am.mjs","line_end":2904,"line_start":2904},{"file":"scripts/am.mjs","line_end":2908,"line_start":2908},{"file":"scripts/am.mjs","line_end":2912,"line_start":2912},{"file":"scripts/am.mjs","line_end":2916,"line_start":2916},{"file":"scripts/am.mjs","line_end":2935,"line_start":2935},{"file":"scripts/am.mjs","line_end":2943,"line_start":2943},{"file":"scripts/am.mjs","line_end":2955,"line_start":2955},{"file":"scripts/am.mjs","line_end":2957,"line_start":2957},{"file":"scripts/am.mjs","line_end":2959,"line_start":2959},{"file":"scripts/am.mjs","line_end":2984,"line_start":2984},{"file":"scripts/am.mjs","line_end":2991,"line_start":2991},{"file":"scripts/am.mjs","line_end":2995,"line_start":2995},{"file":"scripts/am.mjs","line_end":2997,"line_start":2997},{"file":"scripts/am.mjs","line_end":2999,"line_start":2999},{"file":"scripts/am.mjs","line_end":3013,"line_start":3013},{"file":"scripts/am.mjs","line_end":3021,"line_start":3021},{"file":"scripts/am.mjs","line_end":3027,"line_start":3027},{"file":"scripts/am.mjs","line_end":3035,"line_start":3035},{"file":"scripts/am.mjs","line_end":4007,"line_start":4007},{"file":"scripts/am.mjs","line_end":4032,"line_start":4032},{"file":"scripts/am.mjs","line_end":4034,"line_start":4034},{"file":"scripts/am.mjs","line_end":4107,"line_start":4107},{"file":"scripts/am.mjs","line_end":4112,"line_start":4112},{"file":"scripts/am.mjs","line_end":4204,"line_start":4204},{"file":"scripts/am.mjs","line_end":4206,"line_start":4206}]},{"factor":"external_commands","evidence":[{"file":"scripts/am.mjs","line_end":1361,"line_start":1361},{"file":"scripts/am.mjs","line_end":10505,"line_start":10505},{"file":"scripts/am.mjs","line_end":10512,"line_start":10512},{"file":"scripts/am.mjs","line_end":11056,"line_start":11056},{"file":"scripts/am.mjs","line_end":11323,"line_start":11323},{"file":"scripts/am.mjs","line_end":11562,"line_start":11562},{"file":"scripts/am.mjs","line_end":10754,"line_start":10754},{"file":"scripts/am.mjs","line_end":27,"line_start":27},{"file":"scripts/am.mjs","line_end":1146,"line_start":1146},{"file":"scripts/am.mjs","line_end":2694,"line_start":2694},{"file":"scripts/am.mjs","line_end":2701,"line_start":2701},{"file":"scripts/am.mjs","line_end":2717,"line_start":2717},{"file":"scripts/am.mjs","line_end":2721,"line_start":2721},{"file":"scripts/am.mjs","line_end":2728,"line_start":2728},{"file":"scripts/am.mjs","line_end":2735,"line_start":2735},{"file":"scripts/am.mjs","line_end":2747,"line_start":2747},{"file":"scripts/am.mjs","line_end":2752,"line_start":2752},{"file":"scripts/am.mjs","line_end":2797,"line_start":2797},{"file":"scripts/am.mjs","line_end":2804,"line_start":2804},{"file":"scripts/am.mjs","line_end":2845,"line_start":2845},{"file":"scripts/am.mjs","line_end":2860,"line_start":2860},{"file":"scripts/am.mjs","line_end":2867,"line_start":2867},{"file":"scripts/am.mjs","line_end":2875,"line_start":2875},{"file":"scripts/am.mjs","line_end":2888,"line_start":2888},{"file":"scripts/am.mjs","line_end":2896,"line_start":2896},{"file":"scripts/am.mjs","line_end":2904,"line_start":2904},{"file":"scripts/am.mjs","line_end":2908,"line_start":2908},{"file":"scripts/am.mjs","line_end":2912,"line_start":2912},{"file":"scripts/am.mjs","line_end":2916,"line_start":2916},{"file":"scripts/am.mjs","line_end":2935,"line_start":2935},{"file":"scripts/am.mjs","line_end":2943,"line_start":2943},{"file":"scripts/am.mjs","line_end":2955,"line_start":2955},{"file":"scripts/am.mjs","line_end":2957,"line_start":2957},{"file":"scripts/am.mjs","line_end":2959,"line_start":2959},{"file":"scripts/am.mjs","line_end":2984,"line_start":2984},{"file":"scripts/am.mjs","line_end":2991,"line_start":2991},{"file":"scripts/am.mjs","line_end":2995,"line_start":2995},{"file":"scripts/am.mjs","line_end":2997,"line_start":2997},{"file":"scripts/am.mjs","line_end":2999,"line_start":2999},{"file":"scripts/am.mjs","line_end":3013,"line_start":3013},{"file":"scripts/am.mjs","line_end":3021,"line_start":3021},{"file":"scripts/am.mjs","line_end":3027,"line_start":3027},{"file":"scripts/am.mjs","line_end":3035,"line_start":3035},{"file":"scripts/am.mjs","line_end":4007,"line_start":4007},{"file":"scripts/am.mjs","line_end":4032,"line_start":4032},{"file":"scripts/am.mjs","line_end":4034,"line_start":4034},{"file":"scripts/am.mjs","line_end":4107,"line_start":4107},{"file":"scripts/am.mjs","line_end":4112,"line_start":4112},{"file":"scripts/am.mjs","line_end":4204,"line_start":4204},{"file":"scripts/am.mjs","line_end":4206,"line_start":4206}]},{"factor":"network","evidence":[{"file":"scripts/am.mjs","line_end":27,"line_start":27},{"file":"scripts/am.mjs","line_end":10576,"line_start":10576},{"file":"scripts/am.mjs","line_end":10618,"line_start":10618},{"file":"scripts/am.mjs","line_end":10649,"line_start":10649},{"file":"scripts/am.mjs","line_end":11277,"line_start":11277},{"file":"scripts/am.mjs","line_end":1146,"line_start":1146},{"file":"scripts/am.mjs","line_end":2,"line_start":2},{"file":"scripts/am.mjs","line_end":1116,"line_start":1116},{"file":"scripts/am.mjs","line_end":2112,"line_start":2112},{"file":"scripts/am.mjs","line_end":3761,"line_start":3761},{"file":"scripts/am.mjs","line_end":9743,"line_start":9743},{"file":"scripts/am.mjs","line_end":9772,"line_start":9772},{"file":"scripts/am.mjs","line_end":10019,"line_start":10019},{"file":"scripts/am.mjs","line_end":10573,"line_start":10573},{"file":"scripts/am.mjs","line_end":10594,"line_start":10594},{"file":"scripts/am.mjs","line_end":11328,"line_start":11328},{"file":"scripts/am.mjs","line_end":11329,"line_start":11329},{"file":"scripts/am.mjs","line_end":11609,"line_start":11609},{"file":"scripts/am.mjs","line_end":11703,"line_start":11703},{"file":"scripts/am.mjs","line_end":11960,"line_start":11960},{"file":"scripts/am.mjs","line_end":11966,"line_start":11966},{"file":"scripts/am.mjs","line_end":11971,"line_start":11971},{"file":"scripts/am.mjs","line_end":12012,"line_start":12012},{"file":"scripts/am.mjs","line_end":12014,"line_start":12014},{"file":"scripts/am.mjs","line_end":12181,"line_start":12181},{"file":"scripts/am.mjs","line_end":12297,"line_start":12297},{"file":"scripts/am.mjs","line_end":12999,"line_start":12999},{"file":"scripts/am.mjs","line_end":13014,"line_start":13014},{"file":"scripts/am.mjs","line_end":1356,"line_start":1356},{"file":"scripts/am.mjs","line_end":10028,"line_start":10028},{"file":"scripts/am.mjs","line_end":10594,"line_start":10594},{"file":"scripts/am.mjs","line_end":11569,"line_start":11569},{"file":"scripts/am.mjs","line_end":11570,"line_start":11570},{"file":"scripts/am.mjs","line_end":12038,"line_start":12038},{"file":"scripts/am.mjs","line_end":12181,"line_start":12181},{"file":"SKILL.md","line_end":187,"line_start":187},{"file":"SKILL.md","line_end":199,"line_start":199}]}],"critical_findings":[],"high_findings":[{"title":"Environment file access","locations":[{"file":"scripts/am.mjs","line_end":10612,"line_start":10612}],"confidence":0.96,"description":"const headers = { \"content-type\": \"application/json\", ...env.AM_TTS_API_KEY ? { authorization: `Bear","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"AM_TTS_API_KEY becomes a Bearer header for AM_TTS_URL. localSpeech does not require HTTPS or loopback, so remote HTTP exposes credentials and narration."},{"title":"Generic API/secret keys","locations":[{"file":"scripts/am.mjs","line_end":10612,"line_start":10612}],"confidence":0.96,"description":"const headers = { \"content-type\": \"application/json\", ...env.AM_TTS_API_KEY ? { authorization: `Bear","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"The optional AM_TTS_API_KEY is sent to an unrestricted configured URL. Plaintext remote HTTP can disclose the token and narration."}],"medium_findings":[{"title":"Hardcoded IP address","locations":[{"file":"scripts/am.mjs","line_end":11570,"line_start":11570}],"confidence":0.97,"description":"var LAN_BIND = \"0.0.0.0\";","review_kind":"capability","source_category":"network","source_severity":"medium","confidence_reasoning":"The optional LAN mode binds 0.0.0.0 and serves capability URLs over HTTP. Network observers can capture links and read shared private pages."},{"title":"Cloud Narration Selected Without Provider-Specific Consent","locations":[{"file":"references/video.md","line_end":34,"line_start":34},{"file":"scripts/am.mjs","line_end":10562,"line_start":10545}],"confidence":0.96,"description":"Video narration defaults to auto and selects ElevenLabs whenever ELEVENLABS_API_KEY exists. A video request can therefore send private narration externally without a provider-specific choice.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The instructions require a video request but no cloud-provider confirmation. pickProvider chooses ElevenLabs from an ambient key before considering system speech."}],"low_findings":[{"title":"Fetch API call","locations":[{"file":"scripts/am.mjs","line_end":10618,"line_start":10618}],"confidence":0.96,"description":"res = await fetch(url, {","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"localSpeech posts narration and optional Bearer credentials to AM_TTS_URL without transport restrictions. A remote HTTP endpoint exposes this data in transit."},{"title":"HTTP client library","locations":[{"file":"scripts/am.mjs","line_end":10649,"line_start":10649}],"confidence":0.96,"description":"const samples = trimSilence(await request(text2));","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"request(text2) invokes localSpeech against the configured endpoint. Its URL lacks HTTPS or loopback enforcement, so narration can cross an unencrypted remote connection."}],"dangerous_patterns":[],"files_scanned":5,"total_lines":13383,"audit_model":"codex","audited_at":"2026-10-29T14:54:03.426+00:00","created_at":"2026-10-29T15:49:57.771822+00:00","static_findings":[{"id":"blocker:scripts/am.mjs:1116:disk-destruction-command","file":"scripts/am.mjs","pattern":"Disk destruction command","snippet":"var FONT_CSS = { \"bangers\": '/* Bangers, Copyright 2010 The Bangers Project Authors (https://github.","category":"blocker","line_end":1116,"severity":"critical","line_start":1116},{"id":"sensitive:scripts/am.mjs:9268:git-credentials-file","file":"scripts/am.mjs","pattern":"Git credentials file","snippet":"\"^(?:\\\\.netrc|\\\\.npmrc|\\\\.yarnrc(?:\\\\.yml)?|\\\\.pypirc|\\\\.pgpass|\\\\.my\\\\.cnf|\\\\.git-credentials|\\\\.ht","category":"sensitive","line_end":9268,"severity":"critical","line_start":9268},{"id":"sensitive:scripts/am.mjs:9268:netrc-credentials-file","file":"scripts/am.mjs","pattern":"netrc credentials file","snippet":"\"^(?:\\\\.netrc|\\\\.npmrc|\\\\.yarnrc(?:\\\\.yml)?|\\\\.pypirc|\\\\.pgpass|\\\\.my\\\\.cnf|\\\\.git-credentials|\\\\.ht","category":"sensitive","line_end":9268,"severity":"critical","line_start":9268},{"id":"sensitive:scripts/am.mjs:9272:pass-password-store","file":"scripts/am.mjs","pattern":"pass password store","snippet":"var SECRET_DIR = /* @__PURE__ */ new Set([\".git\", \".ssh\", \".aws\", \".azure\", \".gnupg\", \".kube\", \".doc","category":"sensitive","line_end":9272,"severity":"critical","line_start":9272},{"id":"sensitive:scripts/am.mjs:12114:ssh-directory-access","file":"scripts/am.mjs","pattern":"SSH directory access","snippet":"- Files that hold keys by convention (.env, *.pem, id_rsa, .ssh/, .git/ \\u2026) and files with anyth","category":"sensitive","line_end":12114,"severity":"critical","line_start":12114},{"id":"sensitive:scripts/am.mjs:12114:ssh-private-key-file","file":"scripts/am.mjs","pattern":"SSH private key file","snippet":"- Files that hold keys by convention (.env, *.pem, id_rsa, .ssh/, .git/ \\u2026) and files with anyth","category":"sensitive","line_end":12114,"severity":"critical","line_start":12114},{"id":"obfuscation:scripts/am.mjs:1356:long-fromcharcode-sequence","file":"scripts/am.mjs","pattern":"Long fromCharCode sequence","snippet":"var VIDEO_EXPORT_JS = \"// The export engine for the path that has no ffmpeg: the player page drives ","category":"obfuscation","line_end":1356,"severity":"critical","line_start":1356},{"id":"blocker:scripts/am.mjs:639:screen-capture-upload","file":"scripts/am.mjs","pattern":"Screen capture upload","snippet":"var RUNTIME_JS = \"(() => {\\n// How a formula reads in a quote. MathML has no plain text, so src/math","category":"blocker","line_end":639,"severity":"high","line_start":639},{"id":"blocker:scripts/am.mjs:11142:screen-capture-upload","file":"scripts/am.mjs","pattern":"Screen capture upload","snippet":"const screenshot = async () => (await page(\"Page.captureScreenshot\", { format: \"jpeg\", quality: QUAL","category":"blocker","line_end":11142,"severity":"high","line_start":11142},{"id":"sensitive:scripts/am.mjs:27:certificate-key-files","file":"scripts/am.mjs","pattern":"Certificate/key files","snippet":"temml_default = runInThisContext('(function () {\\nvar temml=function(){\"use strict\";class e{construc","category":"sensitive","line_end":27,"severity":"high","line_start":27},{"id":"sensitive:scripts/am.mjs:639:certificate-key-files","file":"scripts/am.mjs","pattern":"Certificate/key files","snippet":"var RUNTIME_JS = \"(() => {\\n// How a formula reads in a quote. MathML has no plain text, so src/math","category":"sensitive","line_end":639,"severity":"high","line_start":639},{"id":"sensitive:scripts/am.mjs:1355:certificate-key-files","file":"scripts/am.mjs","pattern":"Certificate/key files","snippet":"var VIDEO_JS = \"(() => {\\n const D = JSON.parse(document.getElementById('amv-data').textContent);\\n","category":"sensitive","line_end":1355,"severity":"high","line_start":1355},{"id":"sensitive:scripts/am.mjs:1357:certificate-key-files","file":"scripts/am.mjs","pattern":"Certificate/key files","snippet":"var VIDEO_MUX_JS = \"// Minimal WebM (Matroska) writer for the export path that has no ffmpeg: the br","category":"sensitive","line_end":1357,"severity":"high","line_start":1357},{"id":"sensitive:scripts/am.mjs:2115:certificate-key-files","file":"scripts/am.mjs","pattern":"Certificate/key files","snippet":"var FONT_NAMES = Object.freeze(Object.keys(FONTS));","category":"sensitive","line_end":2115,"severity":"high","line_start":2115},{"id":"sensitive:scripts/am.mjs:4540:certificate-key-files","file":"scripts/am.mjs","pattern":"Certificate/key files","snippet":"var STATES = Object.keys(SIGN);","category":"sensitive","line_end":4540,"severity":"high","line_start":4540},{"id":"sensitive:scripts/am.mjs:5076:certificate-key-files","file":"scripts/am.mjs","pattern":"Certificate/key files","snippet":"return Object.keys(this._nodes);","category":"sensitive","line_end":5076,"severity":"high","line_start":5076},{"id":"sensitive:scripts/am.mjs:5079:certificate-key-files","file":"scripts/am.mjs","pattern":"Certificate/key files","snippet":"return this.nodes().filter((e) => Object.keys(this._in[e]).length === 0);","category":"sensitive","line_end":5079,"severity":"high","line_start":5079},{"id":"sensitive:scripts/am.mjs:5082:certificate-key-files","file":"scripts/am.mjs","pattern":"Certificate/key files","snippet":"return this.nodes().filter((e) => Object.keys(this._out[e]).length === 0);","category":"sensitive","line_end":5082,"severity":"high","line_start":5082},{"id":"sensitive:scripts/am.mjs:5103:certificate-key-files","file":"scripts/am.mjs","pattern":"Certificate/key files","snippet":"}), delete this._children[e]), Object.keys(this._in[e]).forEach(n), delete this._in[e], delete this.","category":"sensitive","line_end":5103,"severity":"high","line_start":5103},{"id":"sensitive:scripts/am.mjs:5126:certificate-key-files","file":"scripts/am.mjs","pattern":"Certificate/key files","snippet":"if (n) return Object.keys(n);","category":"sensitive","line_end":5126,"severity":"high","line_start":5126},{"id":"sensitive:scripts/am.mjs:5135:certificate-key-files","file":"scripts/am.mjs","pattern":"Certificate/key files","snippet":"if (n) return Object.keys(n);","category":"sensitive","line_end":5135,"severity":"high","line_start":5135},{"id":"sensitive:scripts/am.mjs:5139:certificate-key-files","file":"scripts/am.mjs","pattern":"Certificate/key files","snippet":"if (n) return Object.keys(n);","category":"sensitive","line_end":5139,"severity":"high","line_start":5139},{"id":"sensitive:scripts/am.mjs:5328:certificate-key-files","file":"scripts/am.mjs","pattern":"Certificate/key files","snippet":"return this._arr.map((e) => e.key);","category":"sensitive","line_end":5328,"severity":"high","line_start":5328},{"id":"sensitive:scripts/am.mjs:5339:certificate-key-files","file":"scripts/am.mjs","pattern":"Certificate/key files","snippet":"return this._arr[0].key;","category":"sensitive","line_end":5339,"severity":"high","line_start":5339},{"id":"sensitive:scripts/am.mjs:5353:certificate-key-files","file":"scripts/am.mjs","pattern":"Certificate/key files","snippet":"return delete this._keyIndices[e.key], this._heapify(0), e.key;","category":"sensitive","line_end":5353,"severity":"high","line_start":5353},{"id":"sensitive:scripts/am.mjs:5372:certificate-key-files","file":"scripts/am.mjs","pattern":"Certificate/key files","snippet":"t[e] = i, t[n] = o, r[i.key] = e, r[o.key] = n;","category":"sensitive","line_end":5372,"severity":"high","line_start":5372},{"id":"sensitive:scripts/am.mjs:5485:certificate-key-files","file":"scripts/am.mjs","pattern":"Certificate/key files","snippet":"if (e.sinks().forEach(o), Object.keys(n).length !== e.nodeCount()) throw new K();","category":"sensitive","line_end":5485,"severity":"high","line_start":5485},{"id":"sensitive:scripts/am.mjs:6505:certificate-key-files","file":"scripts/am.mjs","pattern":"Certificate/key files","snippet":"return l3(u, c), l3(d, f2), Object.keys(r).forEach((h2) => {","category":"sensitive","line_end":6505,"severity":"high","line_start":6505},{"id":"sensitive:scripts/am.mjs:6780:certificate-key-files","file":"scripts/am.mjs","pattern":"Certificate/key files","snippet":"Object.keys(Tn2).forEach((a) => {","category":"sensitive","line_end":6780,"severity":"high","line_start":6780},{"id":"sensitive:scripts/am.mjs:7159:certificate-key-files","file":"scripts/am.mjs","pattern":"Certificate/key files","snippet":"const key = new Map([...nodes.keys()].map((name, i) => [name, nodeKey(i)]));","category":"sensitive","line_end":7159,"severity":"high","line_start":7159},{"id":"sensitive:scripts/am.mjs:9273:crypto-seed-private-key-mention","file":"scripts/am.mjs","pattern":"Crypto seed/private key mention","snippet":"var SECRET_TEXT = /:\\/\\/[^\\s:@/\"'`$<>{}]*:[^\\s@/\"'`$<>{}]+@|sk-ant-|sk-[A-Za-z0-9]{32,}|AKIA[0-9A-Z]","category":"sensitive","line_end":9273,"severity":"high","line_start":9273},{"id":"sensitive:scripts/am.mjs:9267:environment-file-access","file":"scripts/am.mjs","pattern":"Environment file access","snippet":"\"^\\\\.env(?!\\\\.(?:example|sample|template)$)(?:\\\\..*)?$\",","category":"sensitive","line_end":9267,"severity":"high","line_start":9267},{"id":"sensitive:scripts/am.mjs:9909:environment-file-access","file":"scripts/am.mjs","pattern":"Environment file access","snippet":"function amHome(env = process.env) {","category":"sensitive","line_end":9909,"severity":"high","line_start":9909},{"id":"sensitive:scripts/am.mjs:9912:environment-file-access","file":"scripts/am.mjs","pattern":"Environment file access","snippet":"function configPath(env = process.env) {","category":"sensitive","line_end":9912,"severity":"high","line_start":9912},{"id":"sensitive:scripts/am.mjs:9952:environment-file-access","file":"scripts/am.mjs","pattern":"Environment file access","snippet":"function readConfig(env = process.env, themes2 = loadThemes(amHome(env))) {","category":"sensitive","line_end":9952,"severity":"high","line_start":9952},{"id":"sensitive:scripts/am.mjs:9976:environment-file-access","file":"scripts/am.mjs","pattern":"Environment file access","snippet":"function setConfig(key, raw, env = process.env, themes2 = loadThemes(amHome(env))) {","category":"sensitive","line_end":9976,"severity":"high","line_start":9976},{"id":"sensitive:scripts/am.mjs:9982:environment-file-access","file":"scripts/am.mjs","pattern":"Environment file access","snippet":"function resetConfig(key, env = process.env) {","category":"sensitive","line_end":9982,"severity":"high","line_start":9982},{"id":"sensitive:scripts/am.mjs:10040:environment-file-access","file":"scripts/am.mjs","pattern":"Environment file access","snippet":"function catalogUrl(env = process.env) {","category":"sensitive","line_end":10040,"severity":"high","line_start":10040},{"id":"sensitive:scripts/am.mjs:10104:environment-file-access","file":"scripts/am.mjs","pattern":"Environment file access","snippet":"async function fetchIndex(env = process.env, net = {}) {","category":"sensitive","line_end":10104,"severity":"high","line_start":10104},{"id":"sensitive:scripts/am.mjs:10612:environment-file-access","file":"scripts/am.mjs","pattern":"Environment file access","snippet":"const headers = { \"content-type\": \"application/json\", ...env.AM_TTS_API_KEY ? { authorization: `Bear","category":"sensitive","line_end":10612,"severity":"high","line_start":10612},{"id":"sensitive:scripts/am.mjs:11084:environment-file-access","file":"scripts/am.mjs","pattern":"Environment file access","snippet":"function findChrome(env = process.env, platform = process.platform) {","category":"sensitive","line_end":11084,"severity":"high","line_start":11084},{"id":"sensitive:scripts/am.mjs:11149:environment-file-access","file":"scripts/am.mjs","pattern":"Environment file access","snippet":"async function exportMp4(htmlFile, mp4File, { wav: wav2, env = process.env, onProgress = () => {","category":"sensitive","line_end":11149,"severity":"high","line_start":11149},{"id":"sensitive:scripts/am.mjs:11222:environment-file-access","file":"scripts/am.mjs","pattern":"Environment file access","snippet":"async function exportWebm(htmlFile, webmFile, { env = process.env, onProgress = () => {","category":"sensitive","line_end":11222,"severity":"high","line_start":11222},{"id":"sensitive:scripts/am.mjs:11391:environment-file-access","file":"scripts/am.mjs","pattern":"Environment file access","snippet":"spawn3(process.execPath, [scriptPath, \"__update-check\"], { detached: true, stdio: \"ignore\", env: { .","category":"sensitive","line_end":11391,"severity":"high","line_start":11391},{"id":"sensitive:scripts/am.mjs:11605:environment-file-access","file":"scripts/am.mjs","pattern":"Environment file access","snippet":"function readTailscaleStatus(run2 = (cmd) => spawnSync3(cmd, [\"status\", \"--json\"], { encoding: \"utf8","category":"sensitive","line_end":11605,"severity":"high","line_start":11605},{"id":"sensitive:scripts/am.mjs:12114:environment-file-access","file":"scripts/am.mjs","pattern":"Environment file access","snippet":"- Files that hold keys by convention (.env, *.pem, id_rsa, .ssh/, .git/ \\u2026) and files with anyth","category":"sensitive","line_end":12114,"severity":"high","line_start":12114},{"id":"sensitive:scripts/am.mjs:12191:environment-file-access","file":"scripts/am.mjs","pattern":"Environment file access","snippet":"const env = io.env ?? process.env;","category":"sensitive","line_end":12191,"severity":"high","line_start":12191},{"id":"sensitive:scripts/am.mjs:12310:environment-file-access","file":"scripts/am.mjs","pattern":"Environment file access","snippet":"fail(`\\u2717 --replace takes a page that am render wrote (a .html file in ${join11(amHome(ctx.env), ","category":"sensitive","line_end":12310,"severity":"high","line_start":12310},{"id":"sensitive:scripts/am.mjs:12329:environment-file-access","file":"scripts/am.mjs","pattern":"Environment file access","snippet":"const held = !opts.open && hasRetryWarnings(result) && shouldOpen(opts, ctx.env, config.values);","category":"sensitive","line_end":12329,"severity":"high","line_start":12329},{"id":"sensitive:scripts/am.mjs:12730:environment-file-access","file":"scripts/am.mjs","pattern":"Environment file access","snippet":"if (shouldOpen(opts, ctx.env, config.values)) (ctx.io.open ?? openFile)(file);","category":"sensitive","line_end":12730,"severity":"high","line_start":12730},{"id":"sensitive:scripts/am.mjs:9268:npm-config-file-may-contain-tokens","file":"scripts/am.mjs","pattern":"NPM config file (may contain tokens)","snippet":"\"^(?:\\\\.netrc|\\\\.npmrc|\\\\.yarnrc(?:\\\\.yml)?|\\\\.pypirc|\\\\.pgpass|\\\\.my\\\\.cnf|\\\\.git-credentials|\\\\.ht","category":"sensitive","line_end":9268,"severity":"high","line_start":9268},{"id":"sensitive:scripts/am.mjs:9268:pypi-config-file-may-contain-tokens","file":"scripts/am.mjs","pattern":"PyPI config file (may contain tokens)","snippet":"\"^(?:\\\\.netrc|\\\\.npmrc|\\\\.yarnrc(?:\\\\.yml)?|\\\\.pypirc|\\\\.pgpass|\\\\.my\\\\.cnf|\\\\.git-credentials|\\\\.ht","category":"sensitive","line_end":9268,"severity":"high","line_start":9268},{"id":"sensitive:scripts/am.mjs:9268:yarn-config-file","file":"scripts/am.mjs","pattern":"Yarn config file","snippet":"\"^(?:\\\\.netrc|\\\\.npmrc|\\\\.yarnrc(?:\\\\.yml)?|\\\\.pypirc|\\\\.pgpass|\\\\.my\\\\.cnf|\\\\.git-credentials|\\\\.ht","category":"sensitive","line_end":9268,"severity":"high","line_start":9268},{"id":"obfuscation:scripts/am.mjs:1356:heuristic-extremely-long-line-12573-chars-likely","file":"scripts/am.mjs","pattern":"[HEURISTIC] Extremely long line (12573 chars) - likely obfuscated","snippet":"var VIDEO_EXPORT_JS = \"// The export engine for the path that has no ffmpeg: the player page drives ","category":"obfuscation","line_end":1356,"severity":"high","line_start":1356},{"id":"obfuscation:scripts/am.mjs:739:heuristic-extremely-long-line-12594-chars-likely","file":"scripts/am.mjs","pattern":"[HEURISTIC] Extremely long line (12594 chars) - likely obfuscated","snippet":" src: url('data:font/woff2;base64,d09GMgABAAAAACS8AA4AAAAAQFQAACRnAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB","category":"obfuscation","line_end":739,"severity":"high","line_start":739},{"id":"obfuscation:scripts/am.mjs:27:heuristic-extremely-long-line-180603-chars-likel","file":"scripts/am.mjs","pattern":"[HEURISTIC] Extremely long line (180603 chars) - likely obfuscated","snippet":" temml_default = runInThisContext('(function () {\\nvar temml=function(){\"use strict\";class e{cons","category":"obfuscation","line_end":27,"severity":"high","line_start":27},{"id":"obfuscation:scripts/am.mjs:640:heuristic-extremely-long-line-2073-chars-likely-","file":"scripts/am.mjs","pattern":"[HEURISTIC] Extremely long line (2073 chars) - likely obfuscated","snippet":"var DIFF_CSS = \"/* Diff block (only on pages that have one): red and green lines, a hunk row, and tw","category":"obfuscation","line_end":640,"severity":"high","line_start":640},{"id":"obfuscation:scripts/am.mjs:1355:heuristic-extremely-long-line-22189-chars-likely","file":"scripts/am.mjs","pattern":"[HEURISTIC] Extremely long line (22189 chars) - likely obfuscated","snippet":"var VIDEO_JS = \"(() => {\\n const D = JSON.parse(document.getElementById('amv-data').textContent);\\n","category":"obfuscation","line_end":1355,"severity":"high","line_start":1355},{"id":"obfuscation:scripts/am.mjs:2510:heuristic-extremely-long-line-2285-chars-likely-","file":"scripts/am.mjs","pattern":"[HEURISTIC] Extremely long line (2285 chars) - likely obfuscated","snippet":"var x = { codeRemoveIndent: /^(?: {0,3}\\t| {1,4})/gm, outputLinkReplace: /\\\\([\\[\\]])/g, indentCodeCo","category":"obfuscation","line_end":2510,"severity":"high","line_start":2510},{"id":"obfuscation:scripts/am.mjs:1116:heuristic-extremely-long-line-31706-chars-likely","file":"scripts/am.mjs","pattern":"[HEURISTIC] Extremely long line (31706 chars) - likely obfuscated","snippet":"var FONT_CSS = { \"bangers\": '/* Bangers, Copyright 2010 The Bangers Project Authors (https://github.","category":"obfuscation","line_end":1116,"severity":"high","line_start":1116},{"id":"obfuscation:scripts/am.mjs:9063:heuristic-extremely-long-line-3899-chars-likely-","file":"scripts/am.mjs","pattern":"[HEURISTIC] Extremely long line (3899 chars) - likely obfuscated","snippet":"var PAIRS = \"\\u8FD9\\u9019 \\u4E2A\\u500B \\u4EEC\\u5011 \\u8BF4\\u8AAA \\u56FD\\u570B \\u4E3A\\u70BA \\u6765\\u4","category":"obfuscation","line_end":9063,"severity":"high","line_start":9063},{"id":"obfuscation:scripts/am.mjs:729:heuristic-extremely-long-line-4609-chars-likely-","file":"scripts/am.mjs","pattern":"[HEURISTIC] Extremely long line (4609 chars) - likely obfuscated","snippet":"var RTL_CSS = '/* Right-to-left pages (html[dir=\"rtl\"]: Hebrew, Arabic, Persian, Urdu, Yiddish). bas","category":"obfuscation","line_end":729,"severity":"high","line_start":729},{"id":"obfuscation:scripts/am.mjs:1146:heuristic-extremely-long-line-5390-chars-likely-","file":"scripts/am.mjs","pattern":"[HEURISTIC] Extremely long line (5390 chars) - likely obfuscated","snippet":"var LIVE_JS = \"// am serve only: src/serve.js adds this script to the page it sends (never to the fi","category":"obfuscation","line_end":1146,"severity":"high","line_start":1146},{"id":"obfuscation:scripts/am.mjs:1357:heuristic-extremely-long-line-6878-chars-likely-","file":"scripts/am.mjs","pattern":"[HEURISTIC] Extremely long line (6878 chars) - likely obfuscated","snippet":"var VIDEO_MUX_JS = \"// Minimal WebM (Matroska) writer for the export path that has no ffmpeg: the br","category":"obfuscation","line_end":1357,"severity":"high","line_start":1357},{"id":"obfuscation:scripts/am.mjs:730:heuristic-extremely-long-line-6948-chars-likely-","file":"scripts/am.mjs","pattern":"[HEURISTIC] Extremely long line (6948 chars) - likely obfuscated","snippet":"var CHART_CSS = '/* Charts (src/components/chart.js). Only a page with a chart carries this file, th","category":"obfuscation","line_end":730,"severity":"high","line_start":730},{"id":"obfuscation:scripts/am.mjs:639:heuristic-extremely-long-line-77110-chars-likely","file":"scripts/am.mjs","pattern":"[HEURISTIC] Extremely long line (77110 chars) - likely obfuscated","snippet":"var RUNTIME_JS = \"(() => {\\n// How a formula reads in a quote. MathML has no plain text, so src/math","category":"obfuscation","line_end":639,"severity":"high","line_start":639},{"id":"obfuscation:scripts/am.mjs:1:heuristic-multiple-bracket-chains-238-jsfuck-obf","file":"scripts/am.mjs","pattern":"[HEURISTIC] Multiple bracket chains (238) - JSFuck/obfuscation pattern","snippet":"]])(, )})(, ())}","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/am.mjs:27:heuristic-very-high-entropy-string-5-70-bits-lik","file":"scripts/am.mjs","pattern":"[HEURISTIC] Very high entropy string (5.70 bits) - likely encoded/encrypted payload","snippet":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz","category":"obfuscation","line_end":27,"severity":"high","line_start":27},{"id":"obfuscation:scripts/am.mjs:739:heuristic-very-high-entropy-string-6-00-bits-lik","file":"scripts/am.mjs","pattern":"[HEURISTIC] Very high entropy string (6.00 bits) - likely encoded/encrypted payload","snippet":"data:font/woff2;base64,d09GMgABAAAAACS8AA4AAAAAQFQAACRnAAEAAAAAAAAAAAAAAAAAAAAAA...","category":"obfuscation","line_end":739,"severity":"high","line_start":739},{"id":"obfuscation:scripts/am.mjs:1116:heuristic-very-high-entropy-string-6-01-bits-lik","file":"scripts/am.mjs","pattern":"[HEURISTIC] Very high entropy string (6.01 bits) - likely encoded/encrypted payload","snippet":";\\n font-style: normal;\\n font-weight: 400 900;\\n src: url(data:font/woff2;ba...","category":"obfuscation","line_end":1116,"severity":"high","line_start":1116},{"id":"obfuscation:scripts/am.mjs:27:hex-encoded-characters","file":"scripts/am.mjs","pattern":"Hex-encoded characters","snippet":"temml_default = runInThisContext('(function () {\\nvar temml=function(){\"use strict\";class e{construc","category":"obfuscation","line_end":27,"severity":"high","line_start":27},{"id":"obfuscation:scripts/am.mjs:639:hex-encoded-characters","file":"scripts/am.mjs","pattern":"Hex-encoded characters","snippet":"var RUNTIME_JS = \"(() => {\\n// How a formula reads in a quote. MathML has no plain text, so src/math","category":"obfuscation","line_end":639,"severity":"high","line_start":639},{"id":"obfuscation:scripts/am.mjs:1146:hex-encoded-characters","file":"scripts/am.mjs","pattern":"Hex-encoded characters","snippet":"var LIVE_JS = \"// am serve only: src/serve.js adds this script to the page it sends (never to the fi","category":"obfuscation","line_end":1146,"severity":"high","line_start":1146},{"id":"obfuscation:scripts/am.mjs:1193:hex-encoded-characters","file":"scripts/am.mjs","pattern":"Hex-encoded characters","snippet":"var VIDEO_CSS = `/* Video player: the 1920\\xD71080 stage scales to the window. All colors come from ","category":"obfuscation","line_end":1193,"severity":"high","line_start":1193},{"id":"obfuscation:scripts/am.mjs:1355:hex-encoded-characters","file":"scripts/am.mjs","pattern":"Hex-encoded characters","snippet":"var VIDEO_JS = \"(() => {\\n const D = JSON.parse(document.getElementById('amv-data').textContent);\\n","category":"obfuscation","line_end":1355,"severity":"high","line_start":1355},{"id":"obfuscation:scripts/am.mjs:2567:hex-encoded-characters","file":"scripts/am.mjs","pattern":"Hex-encoded characters","snippet":"var ct = h(/^<(scheme:[^\\s\\x00-\\x1f<>]*|email)>/).replace(\"scheme\", /[a-zA-Z][a-zA-Z0-9+.-]{1,31}/).","category":"obfuscation","line_end":2567,"severity":"high","line_start":2567},{"id":"obfuscation:scripts/am.mjs:2572:hex-encoded-characters","file":"scripts/am.mjs","pattern":"Hex-encoded characters","snippet":"var kt = h(/^!?\\[(label)\\]\\(\\s*(href)(?:(?:[ \\t]+(?:\\n[ \\t]*)?|\\n[ \\t]*)(title))?\\s*\\)/).replace(\"la","category":"obfuscation","line_end":2572,"severity":"high","line_start":2572},{"id":"obfuscation:scripts/am.mjs:4049:hex-encoded-characters","file":"scripts/am.mjs","pattern":"Hex-encoded characters","snippet":"const url = decode(value.replace(/^[\"']|[\"']$/g, \"\")).replace(/[\\x00-\\x20\\x7f]/g, \"\").toLowerCase();","category":"obfuscation","line_end":4049,"severity":"high","line_start":4049},{"id":"obfuscation:scripts/am.mjs:4756:hex-encoded-characters","file":"scripts/am.mjs","pattern":"Hex-encoded characters","snippet":"var WORD_LEAD = new RegExp(`^(?:\\\\p{Script=Hebrew}{1,3}[-\\\\u05BE]|[([{\\xAB\\u201C\\u2018\"']|"|","category":"obfuscation","line_end":4756,"severity":"high","line_start":4756},{"id":"obfuscation:scripts/am.mjs:8733:hex-encoded-characters","file":"scripts/am.mjs","pattern":"Hex-encoded characters","snippet":"const ticks = panels.map((p) => ` `
  • ${esc(p.id)} \\xB7 ${esc(p.title)}","category":"obfuscation","line_end":8734,"severity":"high","line_start":8734},{"id":"obfuscation:scripts/am.mjs:9010:hex-encoded-characters","file":"scripts/am.mjs","pattern":"Hex-encoded characters","snippet":"if (text2.includes(c)) out.push({ line, rule: \"cliche\", message: `clich\\xE9 \"${c}\"`, suggestion: \"de","category":"obfuscation","line_end":9010,"severity":"high","line_start":9010},{"id":"obfuscation:scripts/am.mjs:9461:hex-encoded-characters","file":"scripts/am.mjs","pattern":"Hex-encoded characters","snippet":"\"image/png\": (buf) => startsWith(buf, \"\\x89PNG\\r\\n\u001a\\n\"),","category":"obfuscation","line_end":9461,"severity":"high","line_start":9461},{"id":"obfuscation:scripts/am.mjs:9462:hex-encoded-characters","file":"scripts/am.mjs","pattern":"Hex-encoded characters","snippet":"\"image/jpeg\": (buf) => startsWith(buf, \"\\xFF\\xD8\\xFF\"),","category":"obfuscation","line_end":9462,"severity":"high","line_start":9462},{"id":"obfuscation:scripts/am.mjs:9748:hex-encoded-characters","file":"scripts/am.mjs","pattern":"Hex-encoded characters","snippet":"if (language.dir === \"rtl\") return `

    ${label} ${link} ${VERSION} \\x","category":"obfuscation","line_end":9748,"severity":"high","line_start":9748},{"id":"obfuscation:scripts/am.mjs:9749:hex-encoded-characters","file":"scripts/am.mjs","pattern":"Hex-encoded characters","snippet":"return `

    ${label} ${link} ${VERSION} \\xB7 ${time} \\xB7 ${star}

    `;","category":"obfuscation","line_end":9749,"severity":"high","line_start":9749},{"id":"obfuscation:scripts/am.mjs:11039:hex-encoded-characters","file":"scripts/am.mjs","pattern":"Hex-encoded characters","snippet":"