The flagged links are Lovense's own local network domains, which the extension needs to talk to your Lovense app and devices. This is exactly what the extension is designed to do.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
The scanner saw network requests and code that runs on a timer and assumed code was being downloaded and executed. In reality, the extension is sending toy control commands to your local Lovense app on a schedule, which is its intended function.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlated a network retrieval primitive with a code or command execution sink across a broad line range. The network retrieval is a fetch call to the extension's own local SillyTavern proxy endpoint, not a remote download. The visible code contains no eval, Function constructor, or string-based dynamic code execution. The interval-based looping and eventSource registration are standard event-driven JavaScript patterns for parsing AI-generated lovense command tags and relaying them to the local Lovense API. The 'commands' sent are Lovense toy control instructions, not system command execution. All behavior is consistent with the extension's stated purpose.