Is there any tools or trick to verify the forums scripts?

[Crypto Library]

I don't know is that right to asked, besides, I couldn't find a better board where I could get answers from the right people for this.
any get into the main point-
Nowadays we are seeing many many Userscripts in this forum, of course they are pretty useful and also made our life easy in the case of exploring the forum, even I myself also made multiples scripts. Yes, it is true that these are saving our time, but at the same time, we all know that they are also risky because there is also a possibility of my data being stolen. I don't know if there is any example in this forum, what I am saying about.

Now how can a common person, whose programming knowledge is not that hard, actually verify that the scripts will not steal our data or that the accesses they take from our browser will not be sent to a third-party server?
I am mentioning some simple terms/methods here from my point of view, and I would like to know some more tricks or tools from you.

• First, you need to check the user's reputation.
• Ai prompting?(but which functions here might be dangerous?)

[khatarnak]

Whenever you see a script, check things like
-fetch
-XMLHttpRequest
-WebSockets
-external URLs
These do not mean the script is stealing data but they are good things to look at.

[ryzaadit]

I don't know is that right to asked, besides, I couldn't find a better board where I could get answers from the right people for this.

I mostly use two.

[1] Githubs used ScanRepo: https://www.scanrepo.dev/
[2] Virus Total: https://www.virustotal.com/gui/home/upload they have a lot vendor check

These are the most common is being used, it's being regulary being used for other member to report into Report Malware and Suspicious Links here so Mods can take Action !

First, you need to check the user's reputation.[/li][/list]

Not good, always stay neutral.
No matter whether the user has a good reputation or not, always double check for everyting someone shares with you. Some accounts are being compromised, sometimes not changing anything on the victim's account. It's to avoid suspicion.

Ai prompting?(but which functions here might be dangerous?)

There are so much bunch of article from security analysis sharing AI prompts for security checks of files, apps, and others. You can try to use the prompt AI, and then maybe add a little bit of a prompt to give you details for you + a conclusion. So, you will not be confused at all.

[RGBTC]

• Ai prompting?(but which functions here might be dangerous?)

If I don't have the skills to verify code, so AI at least helps me out for the time being. However, I prefer not to install a lot of custom tools; if I do decide to install one, I usually wait a few months after the code is posted so that more competent members have a chance to review it. So far, I haven't installed any forum user scripts. Hahaa.

[mikel_012]

Paste the script to an AI model and ask in the same time:

• Is this code safe and secure?
• What this script can do?
• Can this do malicious things in my browser?

The model wil tell you anything suspicious and you can read what the script can do.

[hd49728]

Now how can a common person, whose programming knowledge is not that hard, actually verify that the scripts will not steal our data or that the accesses they take from our browser will not be sent to a third-party server?

I feel fine with what is available officially by the forum, and I really don't have need of using many user scripts or extensions which have unknown risks. With security reasons, if you are careful and consider security is more important than your curiosity or cool experience with these third-party tools, just stay with official forum features.

Verifying it is the best but if you can not do that, let's wait for experience and feedback of the others after weeks or months before you try to use an user script or extension. It does not eliminate security risk but can minimize it as you can avoid to be very first victims. If you are not technical, just be a normal user, don't want something cool.

[LIST] Bitcointalk.org Userscripts/ Add-ons / SMF patches.
How to detect malicious java script code.

[coinlary]

The model wil tell you anything suspicious and you can read what the script can do.

It's depends . A code may not be malicious, yet still not completely safe to use.

Yes, it can help with some aspects, but it can also miss vulnerabilities in code that could make it unsafe to use in a browser, especially when it comes to using an extension.

It cannot tell what data you will feed into a tool or what exactly the tool will be handling at times, so you should expect it to assume everything is fine with the code even when it isn’t.

[DYING_S0UL]

-snip-

Donno about others, but I simply copy the entire code/file/userscripts (if available), and pastes it into chatgpt or claude and ask him whether there are anything with traces of malicious code. That's it. And if that's not enough, I knock it at VirusTotal's door!

I don't use any super tools to verify scripts, I just follow those two paths...

[Mia Chloe]

~snip

Well the truth is you've just gotta have a fine level of understanding of some of the programming languages that's basically most of it. Depending on how much you understand a particular language the better and more readable it is actually gonna appear to you. As for the AI part you can't really trust them.

AI might be able to detect any anomaly in the code but you really can't rely on them because of inconsistency some prompts like interpreting the code can work but it's not worth it.

[mikel_012]

The model wil tell you anything suspicious and you can read what the script can do.

It's depends . A code may not be malicious, yet still not completely safe to use.

Yes, it can help with some aspects, but it can also miss vulnerabilities in code that could make it unsafe to use in a browser, especially when it comes to using an extension.

It cannot tell what data you will feed into a tool or what exactly the tool will be handling at times, so you should expect it to assume everything is fine with the code even when it isn’t.

And this is why the second question is "What this script can do?"

For example if you need an extension that can make requests to a website it is fine to have this in the code. But if you only need a script to count the number of characters in your post then if the AI tells you the script makings external requests you will know something is wrong

The important thing is the script needs to do what you want it to do and nothing more, and the AI can understand and tell you all of that

[dkbit98]

Now how can a common person, whose programming knowledge is not that hard, actually verify that the scripts will not steal our data or that the accesses they take from our browser will not be sent to a third-party server?

Most newly released userscripts are not that complicated and you can easily see for yourself if the code is redirecting to some third party servers, even if you are not a programmer.
I am not sure anyone would risk forum reputation, but I would ignore all userscrpts from new members.
I suspect that majority of new userscripts are fully written by AI tools 

[lovesmayfamilis]

Regularly reading about the various extensions invented by users, I realize how old-fashioned I am, because my browser still doesn't have any . Once, a bunch of extensions in a browser was called a Christmas tree (heh, I remember that).
Yes, even someone who doesn't understand anything about programming can check all the scripts. The main thing is the desire.

But still.

Using the forum without all these extensions remains quite normal and convenient for me (maybe I work a bit slower, but that's not important to me). What will always be more important is that peace of mind is still more valuable than any doubts about who can do what with these scripts.

People on the internet will remain just people on the internet, with their own plans, motives, and ambitions.

[SilverCryptoBullet]

But still.

Using the forum without all these extensions remains quite normal and convenient for me (maybe I work a bit slower, but that's not important to me). What will always be more important is that peace of mind is still more valuable than any doubts about who can do what with these scripts.

People on the internet will remain just people on the internet, with their own plans, motives, and ambitions.

Many people have their bad habit and practice by installing many softwares, applications, and user scripts while they don't use these things too often. If they use a software, an application, an user script very regularly, I can understand why they take risk but with most people, they only install such things because of curiosity, then very barely use them.

If they have good security mindset, if they no longer use these things, they will remove these things but most people don't do that.

[coinlary]

-snip-

And this is why the second question is"What this script can do?"

Seems you didn't get my comment on this  

It works but it can also miss some critical stuffs in a code. Unless you're good with injecting multiple prompts to run all kind of test, simply just telling it "what can this script do " won't  really solve much . Like I said , the code itself doesn't need to be malicious , but another site running on a different tab or the site you visit while running the extension might be able to exploit its code.

Maybe this will help you understanding better  


That being said, you can have a vulnerable extension and still be fine so far you never visit any site that can exploit it . There are millions of people using vulnerable Android and iOS versions without any issues till date .

[Crypto Library]

Donno about others, but I simply copy the entire code/file/userscripts (if available), and pastes it into chatgpt or claude and ask him whether there are anything with traces of malicious code. That's it. And if that's not enough, I knock it at VirusTotal's door!

I don't use any super tools to verify scripts, I just follow those two paths...

Using AI for very fine is a common and the easiest process; I also used this process in generally to verifying the user script.
But I am saying that you and there is also a member who also suggesting that I can verify this on virus total also, yes I can but if that is a file or a link.
But when it is just a JavaScript code , how did you verify  that on the virus total? Because as I also know that in the virus total we can scan the link or the file or the hash of the file. Do you save it as a file on your computer and then scan it? Isn't that dangerous too?

Regularly reading about the various extensions invented by users, I realize how old-fashioned I am, because my browser still doesn't have any .

Really!!!!
I thought scam busters like you used more and more advanced tools or extensions for the investigation. Even I thought that you used your own extension or script with the help of AI to better explore your own investigations!!!

[PrivacyG]

If you want to stay on the safer side, it is better to not use any Script or extension at all.  I would definitely not resort to 'AI' telling me if a Script is safe to use and I would not download even the small, simple Scripts, even if they came from trust worthy members of Bitcoin Talk.

My argument is very simple.  First of all, I do not know THAT much about Coding to read a Script and understand all of the lines.  Some of them are logical, but it still takes someone who understands the language to find out if there is any thing wrong with it.  Once some thing goes wrong, it will most probably be irreversible.  There fore, why risk that when you could simply browse Bitcoin Talk as it is instead and stay safe and secure.

I have to say there are definitely interesting Scripts that I have seen around here.  But I will most probably never download any of it.  I like Bitcoin Talk as it is, particularly its simplicity any way.

[mikel_012]

-snip-

And this is why the second question is"What this script can do?"

Seems you didn't get my comment on this  

It works but it can also miss some critical stuffs in a code. Unless you're good with injecting multiple prompts to run all kind of test, simply just telling it "what can this script do " won't  really solve much . Like I said , the code itself doesn't need to be malicious , but another site running on a different tab or the site you visit while running the extension might be able to exploit its code.

Maybe this will help you understanding better  


That being said, you can have a vulnerable extension and still be fine so far you never visit any site that can exploit it . There are millions of people using vulnerable Android and iOS versions without any issues till date .

Cute image but this does not make sense in this case

The script that is used here is with the tampermonkey extension and they need to give explicit permission to each website

The AI will very easily say that the script only works on bitcointalk, and in this case another site running on a different tab can not affect the script in any way.

[logfiles]

Paste the script to an AI model and ask in the same time:

• Is this code safe and secure?
• What this script can do?
• Can this do malicious things in my browser?

The model wil tell you anything suspicious and you can read what the script can do.

Claude is actually good for this even if one were using the free tier version. Just to be so sure, I would even slap it onto one of those Chinese models like GLM or Kimi. The risk of having someone with a high-ranking account push a malicious script to members is pretty low but cannot be ruled out.

[2] Virus Total: https://www.virustotal.com/gui/home/upload they have a lot vendor check

I kind of stopped trusting VirusTotal that much in the recent times. Too many overlaps at times (false positives and false negatives)