The extension builds file paths to play sounds, show images, and load maps. It only looks inside its own folder and checks that paths don't escape. This is the normal way the extension works.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The 'shady-link' signal flags construction of URLs from user-provided file names for sounds, images, videos, and map assets. The extension constructs these URLs only within its own extension folder and uses a validateAssetPath function that blocks path traversal ('..', absolute paths). Network requests are limited to local index.json and map JSON files within the extension directory. No evidence of external or arbitrary network destinations. This is expected behavior for an asset-loading extension.
The extension downloads map data and then runs commands you put in your map when you click a zone. This is exactly what it's supposed to do — you create the map file yourself.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: The extension fetches map JSON files from its local folder and then executes slash commands defined in the map's shape scripts via executeSlashCommands on user click. This is the core interactive functionality of the extension: zone-specific commands are user-authored in the map data. No network request reaches external servers; the only code execution is user-supplied slash commands within SillyTavern's sandbox. The correlation between network retrieval and code execution is expected for this extension's design.