Is there any tools or trick to verify the forums scripts?

[Crypto Library]

I don't know is that right to asked, besides, I couldn't find a better board where I could get answers from the right people for this.
any get into the main point-
Nowadays we are seeing many many Userscripts in this forum, of course they are pretty useful and also made our life easy in the case of exploring the forum, even I myself also made multiples scripts. Yes, it is true that these are saving our time, but at the same time, we all know that they are also risky because there is also a possibility of my data being stolen. I don't know if there is any example in this forum, what I am saying about.

Now how can a common person, whose programming knowledge is not that hard, actually verify that the scripts will not steal our data or that the accesses they take from our browser will not be sent to a third-party server?
I am mentioning some simple terms/methods here from my point of view, and I would like to know some more tricks or tools from you.

• First, you need to check the user's reputation.
• Ai prompting?(but which functions here might be dangerous?)

[khatarnak]

Whenever you see a script, check things like
-fetch
-XMLHttpRequest
-WebSockets
-external URLs
These do not mean the script is stealing data but they are good things to look at.

[ryzaadit]

I don't know is that right to asked, besides, I couldn't find a better board where I could get answers from the right people for this.

I mostly use two.

[1] Githubs used ScanRepo: https://www.scanrepo.dev/
[2] Virus Total: https://www.virustotal.com/gui/home/upload they have a lot vendor check

These are the most common is being used, it's being regulary being used for other member to report into Report Malware and Suspicious Links here so Mods can take Action !

First, you need to check the user's reputation.[/li][/list]

Not good, always stay neutral.
No matter whether the user has a good reputation or not, always double check for everyting someone shares with you. Some accounts are being compromised, sometimes not changing anything on the victim's account. It's to avoid suspicion.

Ai prompting?(but which functions here might be dangerous?)

There are so much bunch of article from security analysis sharing AI prompts for security checks of files, apps, and others. You can try to use the prompt AI, and then maybe add a little bit of a prompt to give you details for you + a conclusion. So, you will not be confused at all.

[RGBTC]

• Ai prompting?(but which functions here might be dangerous?)

If I don't have the skills to verify code, so AI at least helps me out for the time being. However, I prefer not to install a lot of custom tools; if I do decide to install one, I usually wait a few months after the code is posted so that more competent members have a chance to review it. So far, I haven't installed any forum user scripts. Hahaa.

[mikel_012]

Paste the script to an AI model and ask in the same time:

• Is this code safe and secure?
• What this script can do?
• Can this do malicious things in my browser?

The model wil tell you anything suspicious and you can read what the script can do.

[hd49728]

Now how can a common person, whose programming knowledge is not that hard, actually verify that the scripts will not steal our data or that the accesses they take from our browser will not be sent to a third-party server?

I feel fine with what is available officially by the forum, and I really don't have need of using many user scripts or extensions which have unknown risks. With security reasons, if you are careful and consider security is more important than your curiosity or cool experience with these third-party tools, just stay with official forum features.

Verifying it is the best but if you can not do that, let's wait for experience and feedback of the others after weeks or months before you try to use an user script or extension. It does not eliminate security risk but can minimize it as you can avoid to be very first victims. If you are not technical, just be a normal user, don't want something cool.

[LIST] Bitcointalk.org Userscripts/ Add-ons / SMF patches.
How to detect malicious java script code.

[coinlary]

The model wil tell you anything suspicious and you can read what the script can do.

It's depends . A code may not be malicious, yet still not completely safe to use.

Yes, it can help with some aspects, but it can also miss vulnerabilities in code that could make it unsafe to use in a browser, especially when it comes to using an extension.

It cannot tell what data you will feed into a tool or what exactly the tool will be handling at times, so you should expect it to assume everything is fine with the code even when it isn’t.

[DYING_S0UL]

-snip-

Donno about others, but I simply copy the entire code/file/userscripts (if available), and pastes it into chatgpt or claude and ask him whether there are anything with traces of malicious code. That's it. And if that's not enough, I knock it at VirusTotal's door!

I don't use any super tools to verify scripts, I just follow those two paths...

[Mia Chloe]

~snip

Well the truth is you've just gotta have a fine level of understanding of some of the programming languages that's basically most of it. Depending on how much you understand a particular language the better and more readable it is actually gonna appear to you. As for the AI part you can't really trust them.

AI might be able to detect any anomaly in the code but you really can't rely on them because of inconsistency some prompts like interpreting the code can work but it's not worth it.

[mikel_012]

The model wil tell you anything suspicious and you can read what the script can do.

It's depends . A code may not be malicious, yet still not completely safe to use.

Yes, it can help with some aspects, but it can also miss vulnerabilities in code that could make it unsafe to use in a browser, especially when it comes to using an extension.

It cannot tell what data you will feed into a tool or what exactly the tool will be handling at times, so you should expect it to assume everything is fine with the code even when it isn’t.

And this is why the second question is "What this script can do?"

For example if you need an extension that can make requests to a website it is fine to have this in the code. But if you only need a script to count the number of characters in your post then if the AI tells you the script makings external requests you will know something is wrong

The important thing is the script needs to do what you want it to do and nothing more, and the AI can understand and tell you all of that

[dkbit98]

Now how can a common person, whose programming knowledge is not that hard, actually verify that the scripts will not steal our data or that the accesses they take from our browser will not be sent to a third-party server?

Most newly released userscripts are not that complicated and you can easily see for yourself if the code is redirecting to some third party servers, even if you are not a programmer.
I am not sure anyone would risk forum reputation, but I would ignore all userscrpts from new members.
I suspect that majority of new userscripts are fully written by AI tools