The extension fetches and saves workflow files from your SillyTavern server and ComfyUI instance, then parses them as JSON to display and edit in the built-in workflow editor. This is normal behavior for a workflow management feature and does not involve any dangerous code execution.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlated a network retrieval primitive (fetch to /api/sd/comfy/workflows) with a dynamic code or command execution sink (JSON.parse, used for workflow JSON handling). The network calls go to SillyTavern's own API endpoints (/api/sd/comfy/...) and to the user-configured ComfyUI instance. These calls use getRequestHeaders() and are standard for the extension's stated purpose of loading, editing, and saving ComfyUI workflow JSON files. The 'execution sink' flagged is JSON.parse, which is standard JSON parsing for workflow data validation and manipulation, not dynamic code execution (e.g., eval, Function constructor). The data flow is consistent with a legitimate workflow editor. No obfuscation, credential exfiltration, or unauthorized execution is present.