The code uses a standard network request to the local SillyTavern server to fetch character details when a user clicks a character card. This is the expected way SillyTavern extensions retrieve data. The nearby event listener code is normal UI handling, not a dangerous code execution path. No external data exfiltration or hidden execution was found.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlates a network retrieval primitive with a code execution sink at lines 327-393. The fetch at line 327 calls the local SillyTavern API endpoint '/api/characters/get' using getRequestHeaders(), which is the standard SillyTavern pattern for retrieving character data. The response is parsed as JSON and used to populate a character details popup. The code in lines 348-423 (closeBox/openBox) contains addEventListener and appendChild calls, which are standard DOM manipulation and event handling, not dynamic code execution sinks (no eval, Function constructor, or script injection in this range). The fetch destination is the local server, not an external endpoint, and the retrieved data is displayed in the UI as expected for this extension's stated purpose. No credential exfiltration, external network calls, or concealed execution is present in the flagged region.
External CDN script loading without integrity verification
low risk · high confidence
The extension loads a markdown rendering library from an internet CDN each time it needs it. While this library is well-known and the version is pinned, loading code from an external source means a compromised CDN could inject malicious code. Bundling the library locally would eliminate this risk.
Technical assessment
The loadMarkedLibrary function dynamically creates a script element with src set to a jsdelivr CDN URL for marked@11.1.1 and appends it to document.head, which executes the loaded JavaScript in the page context. While the library is well-known and the version is pinned, there is no Subresource Integrity (SRI) hash verification, meaning a CDN compromise or man-in-the-middle could serve modified JavaScript. This is a supply-chain weakness common in hobbyist extensions. The loaded code runs with full page-level access to SillyTavern APIs and data.
Impact: low · Exploitability: unlikely
Developer action: Consider bundling marked.js locally or adding a Subresource Integrity (SRI) hash to the script tag to protect against CDN tampering.
Unsanitized markdown rendered via innerHTML from character data
low risk · medium confidence
Character card text is converted from markdown to HTML and inserted directly into the page. If a malicious character card contains specially crafted HTML, it could potentially run unwanted scripts in the browser. This is a common pattern in SillyTavern extensions and the host application, but adding sanitization would improve safety.
Technical assessment
Character data fields (description, first_mes, alternate_greetings) retrieved from the server are passed through renderMarkdown, which calls marked.parse() and assigns the result to innerHTML. Marked v11.x does not sanitize HTML output by default, so character card content containing embedded HTML such as img onerror handlers could be injected into the DOM. Character card data is imported from external sources and is therefore untrusted input. This pattern mirrors the host SillyTavern application's own rendering, so it is an ecosystem-wide pattern rather than a novel risk introduced by this extension, but it remains a potential XSS vector. Risk exposure is not marked demonstrated because the evidence does not show a concrete malicious payload in shipped data, only the code path exists.
Impact: medium · Exploitability: plausible
Developer action: Consider sanitizing markdown output before assigning to innerHTML, or use a DOM sanitizer such as DOMPurify, to prevent HTML injection from untrusted character card content.