The scanner flagged a regular expression as potentially unsafe, but the pattern is a straightforward text parser for user-entered search weight settings. It does not create any security risk; at worst, a pathologically crafted input could cause minor processing delay, which is a normal performance concern rather than a security threat.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The scanner flagged line 552 as an 'unsafe-regex' signal. The actual code is a regex in parseWeights used to parse a small domain-specific language for tag weight assignments (e.g., weight('Female') = 0.3). The pattern /weight(.*?)=([-+]?d*.?d+(?:[eE][-+]?d+)?)/g uses alternation groups and bounded quantifiers that do not produce catastrophic backtracking. The input is a user-typed settings string processed locally with no network flow, no credential access, and no persistence beyond the returned Map. Even if a ReDoS were theoretically possible, the impact would be a local tab slowdown when the user manually enters a crafted weight string, which is low impact. This is expected parsing behavior proportional to the extension's stated search-weight feature.
The scanner flagged this file as potentially obfuscated, but the code is completely readable and straightforward. It is a normal SillyTavern extension that adds search buttons to the UI, opens a search page in a new browser tab, and sends character data to that tab using a standard browser communication channel. There is nothing hidden or deceptive here.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged line 1 as 'obfuscated-code' with high severity but low confidence. The supplied source is entirely plain, readable JavaScript with clear variable names, standard ES module imports from SillyTavern internals, jQuery DOM manipulation, and a BroadcastChannel-based inter-tab communication pattern. The code opens a local HTML page in a new tab, clones the character/tag stores, and sends them via BroadcastChannel to the SPA. It also handles return messages for character selection and detail requests. The globalThis assignments at lines 167-171 expose selectCharacterById and store references for the opened SPA tab. No eval, no dynamic code construction, no encoded strings, no minification, and no concealment are present. This is a false positive from the static scanner; the code is transparent and matches the stated project purpose of a character search extension.
This is a security check, not a threat. The code validates that URLs in character card content only use safe web protocols and blocks dangerous ones like javascript: links that could run unwanted code. This is exactly what a good extension should do.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The scanner flagged line 203 as a 'shady-link' signal, but the actual code at that line is the isSafeUrl function: it constructs a URL object from user-supplied href values and returns true only if the protocol is http:, https:, mailto:, or tel:. This is a defensive URL sanitization routine used by sanitizeHTML_relaxed to block javascript:, data:, and vbscript: protocol handlers in anchor href attributes. The function is part of an HTML sanitization pipeline that removes script tags, strips event handler attributes, and enforces a tight allow-list of tags and attributes. No network request is made; this is purely a protocol validation gate. This is expected, proportionate behavior for an extension that displays character card HTML content in a search interface.