A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The flagged links are just the standard local addresses for popular AI tools like Ollama and LM Studio that run on your own computer. The extension needs these addresses to talk to those local programs, which is exactly what it should do.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
The scanner noticed network calls and code that modifies web pages in the same file. This is normal for a browser extension: it fetches data from SillyTavern's own backend and then updates the chat display using standard web page manipulation. No dangerous code execution was found.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlated network retrieval primitives with a dynamic code execution sink in the same file representation. Examining the actual code in the 2615-3247 range, the network calls are fetch() to relative SillyTavern backend endpoints such as /api/files/delete for deleting expression image files. The 'code execution' signal likely stems from standard DOM manipulation APIs (document.createTreeWalker, document.createElement, document.createTextNode, insertBefore) used to insert placeholder tokens and render expression images in chat messages. No eval(), new Function(), innerHTML with untrusted content, or similar dynamic code execution sinks are visible. The redacted function references [REDACTED_SECRET:613ec97323ea] appear to be placeholder token builders that produce string values inserted as text nodes, which is safe DOM text insertion. All network destinations are relative ST backend paths, not external endpoints.
Credential access and network transmission in one file
Expected behavior · high confidence
The extension uses your API key to authenticate with your chosen AI provider, which is its intended purpose. The key is sent either directly to the provider or through SillyTavern's own backend. No key is sent to any third party or unexpected destination.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The scanner flagged co-occurrence of credential handling and network calls in the same file. The actual data flow shows the user-supplied API key is used to set Authorization Bearer headers sent to one of two destinations: (1) the official provider API endpoint via callOpenAICompatibleAPI or callAnthropicAPI (e.g., api.openai.com, api.anthropic.com), or (2) the SillyTavern backend proxy at relative paths /api/backends/chat-completions/generate and /api/backends/chat-completions/status via callOpenAICompatibleProxyAPI. Both are legitimate and proportional to the extension's stated purpose of calling AI providers for expression suggestions. The Horde anonymous key '0000000000' is a well-known public anonymous identifier. No credentials are sent to any third-party or unexpected destination. The key is stored via extension_settings and persisted locally by SillyTavern's saveSettingsDebounced.