iMacros: Using Javascript with EVAL to replace text in a variable

You missed escaping the quotes in "-", so ended the iMacros string instead of starting a JavaScript string.

You've also potentially got a problem in the /\// regexp, because I suspect iMacros will eat the \/ and turn it into /, leaving JS with the invalid literal ///. It would have to be /\\//.

Also, if the !EXTRACT variable contains quotes, backslashes, or newlines, it will inject those into the JavaScript code directly, breaking the JS string literal and potentially executing arbitrary script.

These are examples of the many problems with nested escaping contexts. You can avoid the first two by using alternate non-clashing quotes, and getting rid of the regex literal by using the simple string replace split/join idiom instead:

SET !VAR1 EVAL("'{{!EXTRACT}}'.split('/').join('-').split(' (')[0]") 

but this still leaves the JS injection problem. From a quick look at the manual, it seems iMacros doesn't have any usable string processing functionality, so you wouldn't be able to do a manual JS-string-literal-replace, or indeed just do the /-to- replacement from within iMacros. That would have been the sensible thing to do; creating executable code from strings is almost always a disastrously wrong thing to strenuously avoid.

[aside rant: From that look at the manual, the existence of iMacros makes me genuinely unhappy. It's offering you a completely arbitrary yet incapable homebrew scripting language instead of just using the already-available JavaScript, then making you go to JS anyway to do anything beyond the laughably trivial... and not giving you tools to transfer values between the two safely. What is even the point of this software? I haven't felt this frustrated with trying to work around wrong-headed language design since the dark days of 4GLs. This is just awful. People use this?]

Your task, like most non-trivial scraping problems can be solved much easier using javascript to organize your imacros code

Take a look at this example. I don't use Wells Fargo so I can't test the actual downloading but the basic skeleton is there

run()
function run() {
  // loginResult is null on success
  var loginError = performLogin()
  if (loginError) {
    alert(JSON.stringify(loginError, null, ' '))
    throw new Error(JSON.stringify(loginError))
  }
  // loginResult is null on success
  var extractError = extractStatement()
  if (extractError) {
    alert(JSON.stringify(extractError, null, ' '))
    throw new Error(JSON.stringify(extractError))
  }
  iimDisplay('Download completed successfully')
}

/**
 * @return null on success, error object on failure
 */
function extractStatement() {
  var error,
      code,
      extract
  code = iimPlay('CODE: TAG POS=1 TYPE=A ATTR=TXT:View<SP>online<SP>statements\n'
                 + 'TAG POS=1 TYPE=A ATTR=TXT:Statement<SP>* EXTRACT=TXT')
  if (code !== 1) {
    error = {
      message: 'error extracting statement',
      error: iimGetLastError(),
      errorCode: code
    }
  }
  extract = iimGetLastExtract()

  // #EANF# means Extract Anchor Not Found (ie extract failed)
  if (extract === '#EANF#') {
    error = {
      message: 'error extracting statement',
      error: 'extract not found'
    }
  }

  // the magic line to replace all slashes
  var filename = extract.replace(/\//g, '-')
  // add the .pdf extension
  filename = filename + '.pdf'

  // download with the new filename, the double slashes are needed because
  // javascrtip otherwise views a backslash as an escape character
  var folderPath = 'D:\\Wells<SP>Fargo\\CREDIT<SP>CARD\\'
  var downloadCode = iimPlay('CODE: ONDOWNLOAD FOLDER=' +folderPath + '  FILE=' + filename + '\n'
                             + 'TAG POS=1 TYPE=A ATTR=TXT:Statement<SP>* CONTENT=EVENT:SAVETARGETAS\n'
                            + 'TAB CLOSE')

  if (downloadCode !== 1) {
    error = {
      message: 'failed to download statement',
      error: iimGetLastError(),
      errorCode: downloadCode
    }
    return error
  }

  // download completed correctly
  return null
}

/**
 * @return null on success, error object on failure
 */
function performLogin() {
  var code = iimPlay('CODE: TAB OPEN\n'
                     + 'TAB T=2\n'
                     + 'URL GOTO=https://online.wellsfargo.com/login\n'
                     + 'TAG POS=1 TYPE=INPUT:TEXT FORM=ID:Signon ATTR=ID:username CONTENT=XXX\n'
                     + 'SET !ENCRYPTION TMPKEY\n'
                     + 'TAG POS=1 TYPE=INPUT:PASSWORD FORM=ID:Signon ATTR=ID:password CONTENT=XXX\n'
                     + 'TAG POS=1 TYPE=INPUT:SUBMIT FORM=ID:Signon ATTR=NAME:continue&&VALUE:Sign<SP>On\n')

  // code will be 1 on success
  if (code === 1) {
    return null
  }
  var error = {
    message: 'error performing login',
    error: iimGetLastError(),
    errorCode: code
  }
}