The scanner flagged the code as potentially obfuscated, but the full source is plainly readable and well-commented. It is a standard SillyTavern extension that coordinates voice input and text-to-speech. There is no hidden behavior, secret data flow, or suspicious activity.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner's obfuscation signal is a false positive. The supplied source is a single IIFE with clear variable names, inline comments, and straightforward logic. Data flows are limited to: reading/writing a localStorage boolean toggle, DOM manipulation of the SillyTavern microphone button, hooking window.speechSynthesis.speak/cancel to track TTS start/end, and calling navigator.mediaDevices.getUserMedia for local voice-activity detection via Web Audio API. No network requests, no credential access, no eval, no dynamic code execution, no encoded strings, and no external destinations are present. All capabilities directly match the stated project purpose of half-duplex TTS/STT sequencing with silence detection. The IIFE wrapper and rest-spread syntax in the log helper likely triggered the heuristic, but these are ordinary JavaScript patterns.