The extension fetches its own local HTML menu file from the SillyTavern server and separately loads its own local code modules on demand. These are standard, independent operations for a SillyTavern extension and do not create a path from downloaded content into code execution.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlates a network retrieval primitive with a dynamic code execution sink in the same file. The actual code shows: (1) a fetch() at line 223 that retrieves a static HTML file ('rewriteContextMenu.html') from the extension's own same-origin path on the local SillyTavern server, with the result inserted into the DOM via insertAdjacentHTML for UI rendering; and (2) dynamic import() calls at lines 129 and ~263 that use hardcoded relative paths ('./messageManager.js' and '../guidedRewrite.js') to lazily load local extension modules. There is no data flow from the fetch response into any code execution sink. The fetch response is treated as HTML text for DOM insertion, not as executable code. The import() specifiers are static strings with no attacker-controlled input. These are independent, expected operations for a SillyTavern extension loading its own UI template and modules.
Impact: none · Exploitability: unlikely
Developer action: Review the cited evidence and confirm the intended behavior.
Incomplete HTML escaping of character names in popup construction
low risk · high confidence
Character names are inserted into a popup menu with only partial escaping. If a character name contains certain special characters, it could break the menu's HTML or cause unexpected display issues. Since users set their own character names, this is primarily a self-inflicted display problem rather than an attack vector.
Technical assessment
Detailed technical wording was omitted by the public report safety filter.
Impact: low · Exploitability: unlikely
Developer action: Review the cited evidence and confirm the intended behavior.