RoC Wiki Goods

AI Security Review

Evidence context: threat category none; evidence quality strong.

This Firefox extension enhances the Rise of Cultures wiki with dropdown selectors, resource tracking checkboxes, and calculation tools for construction and upgrade tables. The automated security scanner flagged 129 medium-severity findings, but these are overwhelmingly false positives from known scanner limitations.

All 128 domain-related findings are property access chains misidentified as network destinations. For example, "XIOC-DOMAIN-t.actions.search" and "XIOC-DOMAIN-n.style.gap" are JavaScript property references like t.actions.search or n.style.gap, not actual domain names. Similarly, "XIOC-DOMAIN-g.to" and "XIOC-DOMAIN-r.compare" represent method chaining patterns in minified code. These patterns are documented false positives that occur when scanners cannot distinguish between legitimate object.property syntax and actual domain strings. Other flagged items like "XIOC-DOMAIN-r.gold", "XIOC-DOMAIN-t.food", and "XIOC-DOMAIN-nodefilter.show" follow the same pattern of property access chains.

The extension contains zero malware signatures, zero obfuscation indicators, and zero code-smell findings. This is significant because actual malicious extensions typically show at least one of these signals. The single network finding is consistent with a wiki enhancement tool that may need to fetch game data or wiki resources.

The extension's developer field is empty, which raises questions about accountability. However, this is common for small community-maintained tools targeting niche audiences. With only 25 users, this is clearly a specialized utility rather than a mass-market product. The description accurately describes a game wiki enhancement tool, and there is no evidence of browser hijacking, credential theft, or proxyware functionality.

Counterargument: A skeptic might argue that an anonymous developer with 129 flagged findings warrants caution. However, the nature of these findings matters more than the count. Every single flagged "domain" is a property access chain, not a real network destination. If this were malicious code, we would expect to see actual suspicious domains like custom search engines or data exfiltration endpoints, malware signatures, obfuscation, or code-smell findings. None of these are present. The findings are scanner noise, not evidence of harm.

Conclusion: This extension is a legitimate game wiki tool with automated scanner false positives. The findings should be suppressed as known false positive patterns.

Key Reasons

• All 128 domain findings are property access chains (t.actions.search, n.style.gap, g.to) not real domains
• Zero malware signatures detected
• Zero obfuscation indicators present
• Zero code-smell findings
• Extension purpose matches description (game wiki enhancement tool)

False Positive Considerations

• IoC extractor misreading property access chains as domains
• No malware signatures present
• No obfuscation or code-smell indicators
• Legitimate extension purpose (game wiki enhancement)

Reviewed 2026-05-25; recommended action: suppress false positive; model confidence 85%.