Third-Party script risk analyzer

This inventory reads markup and nothing else. Scripts that a tag manager, an ads slot, or an analytics loader injects while the page runs are invisible here; the honest proxy is the loader tag itself, which does appear. A script list without findings is not an audit: the scan cannot see what the served files contain, who operates the domains, or what the page does while it runs, and it never executes any of it to find out. CORS may also stop the body read of a cross-origin page, in which case view-source and paste mode cover the gap.