XSS fishy code

search bar on app can be used to run js script. although upon further inspection, this kind of behaviour is not exploitable.