The scanner flagged this file as potentially obfuscated, but the code is completely readable and well-commented. It is a straightforward SillyTavern extension that tints character sprites to match the background color. No hidden or suspicious behavior is present.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The JS-X-Ray obfuscated-code signal is a false positive. The supplied source is plain, readable, well-commented JavaScript with clear variable names and structure. The extension imports standard SillyTavern APIs (extension_settings, getContext, saveSettingsDebounced, this_chid), computes the average color of the background image via a 1x1 canvas draw, creates a canvas overlay on character sprite images using composite operations, observes DOM mutations for sprite and background changes, persists a blend-mode setting through extension_settings, and loads a local settings HTML fragment from the extension folder. No eval, no dynamic code generation, no encoded strings, no external network calls, no credential access, and no obfuscation are present. All behavior matches the stated project purpose of applying a color filter to character sprites.
Background image URL extraction and canvas pixel sampling
low risk · high confidence
The extension reads the background image to calculate its average color for tinting. This is local processing only and matches the stated purpose.
Technical assessment
getAverageColorFromUrl loads a background image URL extracted from the bg1 element's inline style, draws it to a 1x1 canvas, and reads a single pixel to derive an average color. This is a local DOM/canvas operation with no external network destination beyond the already-loaded background image. The crossOrigin attribute is set to Anonymous. No data is transmitted anywhere.