The scanner flagged line 1 as possibly obfuscated, but the actual code is plainly readable, well-commented JavaScript with no hidden logic or encoded behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner reported a low-confidence obfuscation signal at line 1, but the supplied source shows fully readable, heavily commented JavaScript starting with a banner comment. The code imports standard SillyTavern APIs, manages local extension settings, chat metadata, and group state, and uses standard debounced save functions. No encoded strings, eval, dynamic code generation, or concealed execution is present in the supplied evidence. The signal is a false positive.
No external network calls or credential access in supplied source
low risk · high confidence
The code only stores and retrieves local configuration using normal SillyTavern APIs, with no network calls or data leaving the application.
Technical assessment
Imports are limited to standard SillyTavern extension APIs (script.js, extensions.js, popup.js, group-chats.js, openai.js) and local sibling modules. No external network endpoints, credential access, or obfuscated data flows are visible in the supplied source. Data is persisted via saveSettingsDebounced and saveMetadataDebounced, which are the expected local persistence mechanisms for this extension type.