An automated scanner hinted this file might be hiding what it does. Reading the actual code shows normal, clearly written program logic: it prepares prompts and sends tracker generation requests using the connection the user picked. Nothing is disguised or hidden.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged an obfuscated-code signal with low scanner confidence, but the supplied source for this file is plainly readable, well-commented module code. It resolves a connection profile, reads a preset's max-token setting, renders user templates with macro substitution, and sends tracker generation requests through SillyTavern's connection-manager service. There are no encoded strings, packed payloads, concealed dispatch, or hidden execution paths; the flag is a false positive on readable code. The model calls it visible to the user, aligned with the extension's stated purpose of tracker generation over a dedicated connection, and the preset mutation is restored in a finally block.
Detailed wording was omitted by the public report safety filter.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: low · Exploitability: unlikely
Developer action: Consider showing a clear warning when an imported preset contains a custom JavaScript snippet, so users understand that applying a shared preset executes the code it carries.
An automated scanner hinted this file might be hiding what it does. The actual code is ordinary settings handling: it sets up the extension's options screen, migrates older saved settings to the new format, and fills in the connection and preset menus. Nothing is disguised.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged an obfuscated-code signal with low scanner confidence, but the supplied source is transparent settings-management code: it initializes and migrates extension settings, loads the settings UI from the extension's own folder, populates dropdowns from the host's connection-profile and completion-preset managers, and registers UI event listeners. All data stays local between the extension settings, the host context, and the debounced settings save. No encoded payloads, hidden execution, or unusual destinations are present, so the signal is a false positive on readable code.
The flagged text is just a standard label that says which format a small settings object uses. It looks like a web address, but the program never visits it—it is the same kind of label used in millions of schema definitions. Nothing in this file contacts the internet or sends data anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The scanner flagged a fixed literal at the schema-declaration property inside the tool-parameter object passed to SillyTavern's ToolManager. The matched value is the standard JSON Schema dialect identifier URI (draft-04), a declarative namespace string used to identify the schema dialect. It is metadata in a tool definition object, never fetched, dereferenced, or used in any network request; the surrounding code registers a read-only function that returns locally stored tracker text. No outbound connection, destination, credential access, or untrusted-input data flow exists anywhere in the supplied file.