This extension lets you write your own JavaScript snippet to customize how trackers are displayed, and it runs that snippet—which is fine when you typed it yourself. The problem is that these snippets are also saved inside preset files, and when someone imports a preset file shared by another person, the extension quietly runs whatever JavaScript that file contains the moment the preset is selected. A preset looks like harmless settings, but here it can carry hidden program code. If a user is talked into importing a malicious preset, that code runs in their SillyTavern window and can do things
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: high · Exploitability: plausible
Developer action: Review the cited evidence and confirm the intended behavior.
The automated scanner suspected hidden or scrambled code here, but the actual file is normal, clearly written code. It reads your chat and your chosen connection settings, asks the model to produce a tracker, and saves the result—all of which is exactly what this extension says it does. Nothing is disguised or sent anywhere unexpected.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged an obfuscated-code signal, but the supplied source is plainly readable, commented, non-minified JavaScript with transparent imports and straightforward logic. The file reads host chat state, connection profiles, and completion presets, then sends tracker-agent prompts through SillyTavern's own ConnectionManagerRequestService, with a temporary profile preset override that is restored in a finally block. No string decoding, packed payloads, encoded literals, concealed destinations, or hidden execution paths appear in any supplied representation. All data flows (chat messages, world info, tracker prompts) stay within the user-configured model connection and match the extension's stated purpose of generating trackers on an independent connection.
The scanner thought it saw scrambled or hidden code, but this file is ordinary settings code: it sets up the extension's options panel, keeps old settings working after updates, and lets you pick connection profiles and presets. Everything it touches stays within SillyTavern's normal extension framework, and nothing is disguised.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner raised an obfuscated-code signal, but the supplied source is legible settings-management code: it migrates and merges extension settings, builds settings UI from local HTML, populates connection-profile and completion-preset dropdowns from SillyTavern's context, and persists changes through SillyTavern's own debounced settings saver. No encoded strings, packed code, hidden destinations, or concealed execution appear in the supplied representations. The migrations mutate only the extension's own settings object, and all network-adjacent behavior is deferred to SillyTavern's existing services. This matches the extension's stated purpose and normal extension capabilities.
The flagged 'link' is just a standard labeling string used inside a tool definition that says which format the tool's settings follow. Nothing in this code contacts that address or any other website; the string is purely a label, like citing a document standard by name.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The scanner's shady-link signal corresponds to the JSON Schema draft-04 identifier string appearing in the tool parameter definition. This is a declarative schema URI conventionally used in tool/function definitions; it is a metadata literal, not a fetched URL. The file contains no network requests, no fetch or HTTP client usage, and no data flow to any external destination. The surrounding code registers a local tool with SillyTavern's ToolManager that returns an in-memory tracker payload, consistent with the extension's stated purpose of injecting scene-state data into prompts.