A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The flagged links are just addresses of well-known AI services and local AI programs running on the user's own computer. Contacting these services is exactly what the extension is supposed to do, and the user picks which service to use.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The scanner flagged HTTP URLs on line 65 and similar lines, matching the localhost base URLs for local inference servers (Ollama, llama.cpp, KoboldCPP, LM Studio, Aphrodite). These are the standard well-known local ports for those backends and are clearly labeled as local providers in the visible source. The remaining URLs in the file are HTTPS endpoints of well-known AI model providers (OpenAI, Anthropic, DeepSeek, xAI, Groq, Perplexity, OpenRouter, Horde). All destinations are consistent with the extension's stated purpose of generating character-expression suggestions via AI providers, and the user is the one selecting the provider. No obfuscated, dynamic, or unexpected destination is present, and the anonymous Horde key is a public constant, not a credential.
The extension does download images, but only the user's own expression pictures, which it converts and saves into a backup file. It also loads a standard bundled library from SillyTavern itself. Nothing downloaded is ever run as code, so the scanner's warning about 'download then execute' does not match what the code actually does.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Anthropic API key sent directly from the browser to the provider endpoint
low risk · medium confidence
For one provider, the extension contacts the AI service directly from the browser instead of going through SillyTavern's own server. The key still only goes to the legitimate service it belongs to, so nothing is leaked, but the approach is inconsistent with how other providers are handled.
Technical assessment
Most providers route requests through the SillyTavern backend proxy endpoint using host request headers, which keeps credentials and CORS handling server-side. The Anthropic branch instead performs a direct browser fetch to the Anthropic messages endpoint with the user-supplied key in a request header. The destination is the legitimate, hard-coded provider endpoint selected by the user, and the key travels only to that provider, so this is an ordinary direct-to-provider pattern rather than exfiltration. It does differ from the proxy pattern used for other providers and relies on the provider's CORS support.
Impact: low · Exploitability: unlikely
Developer action: Consider routing the Anthropic call through the same SillyTavern backend proxy path used for the other providers for consistency and to avoid browser-side credential handling.