Inazuma Shrine of Depths Genshin Impact Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

An empty permissions array and an empty host_permissions array are the two most important facts here. In Chrome, that combination means Inazuma Shrine of Depths Genshin Impact Live Wallpaper cannot read your tabs, your cookies, your history or the content of any page you visit, and it cannot swap out your search engine. A live wallpaper that replaces the new tab page needs nothing beyond the new tab override, so the manifest matches the stated purpose.

The 399 indicator matches are not evidence of traffic going anywhere. Look at what got extracted: 0q.gn, 1md.pf, 1s.jo, 2l.kg, ax.bb, bsz.do. None of those are hostnames. They are two and three character runs pulled out of minified JavaScript, and the extractor even splits multi-byte characters, which is why 1w쫆.vg and cwмsg.bt show up in the list. A squashed bundle of a few hundred kilobytes produces hundreds of these by accident. No malware signature matched anywhere in the package, the obfuscation check did not fire, and no secret was found.

The six network findings are real fetch calls and worth naming: js/background.js:63, js/background.js:82, js/background.js:96, js/popup.js:39, js/sidePanel.js:362 and js/weather.js:49. The weather.js call is the easiest to account for. A wallpaper extension of this shape typically carries a small weather or clock widget in its side panel, and that file name says as much. The background.js calls are where a wallpaper would pull the video or still image it rotates through, and popup.js:39 would refresh a preview thumbnail. None of these findings carries a resolved URL, so the shape is visible but the destination is not. What is visible is that they sit alongside no credential access, no cookie API and no content script injection.

The 47 code-smell hits are low severity and match ordinary JavaScript patterns: fetch, timers, DOM writes. These rules fire on almost any bundle, and none of the matches describes behaviour a wallpaper page would not need.

The strongest argument against this reading is that those fetch calls do reach somewhere, and a new tab extension could phone home with usage data without needing a single permission to do it. That is fair, and it is why the destination of js/background.js:82 is the one thing worth watching across future versions. Sending a request and being able to read your browsing are different capabilities, though, and this package has none of the second. With zero permissions, zero signatures, zero obfuscation and an indicator list made entirely of minifier debris, nothing found here rises above the level of a weather widget.

Key Reasons

• Empty permissions and host_permissions arrays leave no access to tabs, cookies, history or page content
• Zero malware signatures, zero obfuscation findings and zero secrets across the whole package
• 399 indicator matches are minifier debris such as 0q.gn and ax.bb rather than resolvable hostnames
• Six fetch calls in js/background.js, js/popup.js, js/sidePanel.js and js/weather.js fit wallpaper rotation and a weather widget
• 47 code-smell findings are low severity and match generic fetch, timer and DOM patterns

False Positive Considerations

• Minified JavaScript fragments parsed as domain names, including split multi-byte characters like cwмsg.bt
• Low-severity code-smell rules firing on standard fetch and DOM patterns
• Empty permission set means the flagged fetches have no sensitive data to carry
• js/weather.js:49 accounts for one network finding as a weather widget call

Reviewed 2026-10-17; recommended action: suppress false positive; model confidence 78%.