No material or immediate-danger item was identified.
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Minor caution · medium confidence
This code tries to fix broken AI-generated JSON as a last resort by running it as JavaScript. That's risky if someone could sneak bad code into the AI's response, but the AI is your own and most inputs are already caught by safer methods. The developer added a safety switch so callers can turn this off when handling untrusted data.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: Line 77 uses the Function constructor (`new Function("use strict"; return (${cleaned});`) as a last-resort JSON parse when `allowFunctionEval` is true (the default). Input has been preprocessed (code fences, comments, thinking tags removed) and earlier JSON.parse attempts failed. The data source is AI model output from the user's own configured provider, not third-party content. The result is validated to be an object before returning. Although the risk is low because control over AI output requires adversary-influenced model response, the Function constructor still executes arbitrary JavaScript if an attacker could craft a malicious string that evades earlier parsing. The JSDoc documents the option to pass `allowFunctionEval: false` for untrusted input, which mitigates exposure.
Impact: low · Exploitability: unlikely
Developer action: Consider adding a console.warn when the Function constructor path is taken, to increase visibility for users. The existing opt-out flag and documentation are already good practice.
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- src/utils/jsonRepair.js:77
Contextual expected matches (28)
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This file appeared suspicious to an automated tool, but the actual code is clear and straightforward. It manages a character editor popup — letting you change portraits, dialogue colors, and set story hooks — exactly as described in the project's feature list.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The JS-X-Ray obfuscated-code signal is a false positive. The supplied source code for characterWorkshop.js is fully readable, well-commented, and implements legitimate per-character editing features (identity, appearance, injection/ejection/banning of characters from scenes, knife story-beat management). All API interactions (extension prompts, settings persistence, event listeners) use standard SillyTavern extension mechanisms. No concealed execution, obfuscation, or malicious data flow is present. The scanner likely flagged benign regex patterns or template literal escaping.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/systems/ui/characterWorkshop.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · medium confidence
The flagged code looks like ordinary, readable program code despite the scanner's warning. There is no evidence that the code is hidden or scrambled.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The scanner reports a generic obfuscation signal with low confidence and no retained matched literals. The supplied source is plain, readable JavaScript with descriptive function names and explanatory comments. No encoding, packed strings, hidden evaluation, or other obfuscation technique is visible in the provided evidence. The signal does not correspond to demonstrated behavior in the artifact.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/core/persistence.js:1
JavaScript analysis reported javascript.download-to-execution
Expected behavior · low confidence
The security scanner thought this file might download code and run it, but the actual code doesn't download anything from the internet. It only updates the character portrait display on the screen.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: The scanner flagged a correlation between network retrieval and a code execution sink, but the provided source code (portraitBar.js) does not contain any network retrieval primitives (fetch, XMLHttpRequest). The only code execution sink is innerHTML assignment in htmlToElement, which operates on sanitized template strings with escapeHtml usage. No user-controlled input reaches eval, Function, or dynamic imports. The scanner alert appears to be a false positive given the evidence.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- src/systems/ui/portraitBar.js:252-909
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This file is just a configuration and state management module with clear comments. The scanner mistook a harmless embedded image (a fallback avatar) for obfuscated code, but there's nothing hidden or tricky here.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The scanner flagged 'obfuscated-code', but the actual source code in state.js is well-documented, readable JavaScript containing plain configuration objects and utility functions. The base64-encoded SVG fallback avatar data URI (FALLBACK_AVATAR_DATA_URI) is a static embedded image, not obfuscated logic. No concealment, dynamic code generation, or string encoding that hides intent is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/core/state.js:1
OpenGrep reported tavernkeeper.credential-exfiltration.javascript-secret-to-network
Expected behavior · high confidence
The extension uses your API key to connect to the AI service you set up, which is exactly what it is supposed to do.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.credential-exfiltration.javascript-secret-to-network in this repository.
Contextual assessment: This is the same code as the previous candidate: the extension retrieves an API key from secure storage and uses it in a fetch call to the user-configured external API endpoint. This is the intended behavior for the external generation mode and is proportional to the extension's purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.credential-exfiltration.javascript-secret-to-network
- File role
- production
- Source
- src/systems/generation/apiClient.js:68-77
JavaScript analysis reported javascript.download-to-execution
Expected behavior · medium confidence
The file fetches a number from a public web service to show how many stars the project has, and it lazily loads its own UI screens when buttons are clicked. It does not download and run remote code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: The flagged region contains a request to a public repository metadata endpoint and dynamic module imports triggered by user interaction. The response is parsed only to extract a numeric star count for display. No data from that request flows into an evaluation, command execution, or other code-execution sink, and no fetched remote script content is executed. The scanner's download-to-execution correlation is not supported by a demonstrated data flow in the supplied evidence.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- index.js:183-228
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
A security scanner thought this file might have hidden code, but looking at the actual code shows it is normal and readable, not hidden or scrambled. There is no security issue.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The scanner signal for obfuscated code is not supported by the actual file content. The source code is plain, readable JavaScript with clear comments and standard module structure. The low scanner confidence and the presence of clear source indicate a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/systems/ui/characterRoster.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · low confidence
This file handles scene header displays and is written in plain, readable code. The security warning is incorrect—the code does what it says and nothing hidden.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The JS-X-Ray obfuscated-code signal is a false positive. The full source code is clean JavaScript with detailed JSDoc comments, modular functions for drag-and-drop HUD, theme color palettes, and incremental scene transition logic. No obfuscation, concealed execution, or credential handling is present. The scanner likely flagged the use of dynamic CSS property generation or DOM manipulation, which is expected for a rendering module.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/systems/rendering/sceneHeaders.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This code checks whether an image generation result looks like a valid link or data URI before using it. It doesn't make any internet connections itself. The scanner saw the word 'http' and worried about suspicious links, but it's just a normal safety check.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged extractImageUrl function validates that a result string starts with 'http', 'data:', or '/' to confirm it is a plausible image URL. This is input validation after calling SillyTavern's /sd slash command, which returns a generated image URL. No actual network request is initiated by this function; it only checks the format of an already-retrieved value. This is standard, safe API result handling.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/systems/features/avatarGenerator.js:673
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The automated scanner thought this file might download something and then run it as code, but looking at the actual code, it doesn't do that. It's just a settings panel for characters - no risky network requests or code execution.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: The scanner flagged a correlation between network retrieval and code execution within the large line range, but the actual code in characterWorkshop.js shows no network retrieval calls (fetch, XMLHttpRequest) and no dynamic code execution sinks (eval, new Function, script injection). All DOM updates use safe jQuery methods with escaped content. The pattern detected is a false positive due to broad correlation matching.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- src/systems/ui/characterWorkshop.js:839-1705
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
A security scanner flagged this file as possibly containing hidden or scrambled code, but the actual code is clear and readable. There is no obfuscation here. This is a false alarm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The scanner reported a low-confidence obfuscation signal on line 1, but review of the complete source file shows standard, well-documented JavaScript with no obfuscation. The code uses clear variable names, comments, proper module imports, and straightforward DOM manipulation. The heuristic signal is a false positive; the file exhibits expected behavior for a UI module in a SillyTavern extension.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/systems/ui/portraitBar.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
The security scanner thought the code was hidden or scrambled, but the actual code is clearly written and easy to read. It just manages settings for the scene tracker.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The scanner flagged obfuscated code, but the source code (trackerEditor.js) is clearly readable with standard JavaScript syntax, descriptive comments, and no minification or encoding tricks. The scanner confidence was low, and the provided evidence confirms no obfuscation is present. This is a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/systems/ui/trackerEditor.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
A scanner thought this file might contain hidden or scrambled code, but it's actually a normal, readable script that handles the plot twist feature. Nothing suspicious was found.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The JS-X-Ray scanner flagged this module with low confidence for obfuscated code, but the actual source is plain, well-commented JavaScript. The file implements the Doom Counter system (tension tracking, countdown, twist/knife generation) and contains no encoded or concealed logic. The scanner alert is a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/systems/generation/doomCounter.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The code contains a built-in placeholder image (a question mark icon) for characters without a custom avatar. The scanner thought it might be a suspicious link, but it's just an embedded picture, not something that connects to the internet.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged line (607) defines FALLBACK_AVATAR_DATA_URI, a base64-encoded SVG data URI for a fallback avatar icon. This is a static inline resource, not an external URL or a network request. There is no shady link, dynamic URL construction, or data exfiltration risk.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/core/state.js:607
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This code checks if a portrait image is a data URL (embedded image). It only talks to your own SillyTavern server, not to any shady outside website. The security alert is a false alarm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The 'shady-link' signal at line 71 corresponds to a `data:` URL prefix check in `isDataUrl()`. The file uses `fetch()` only against SillyTavern's own `/api/images/upload` and `/api/images/delete` endpoints for legitimate avatar/portrait persistence. No external or suspicious domain destinations are present. The scanner signal is a false positive from the `data:` string literal.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/utils/avatars.js:71
JavaScript analysis reported javascript.credential-to-network
Expected behavior · medium confidence
The file can read chat data and settings, and it can make internet requests for its features, but the evidence does not show any request carrying passwords, keys, or private chat content to a third party.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.credential-to-network in this repository.
Contextual assessment: The scanner correlates credential-bearing state imports with an outbound network sink across a large file region, but the supplied evidence shows no path where credentials are read and transmitted to an external destination. Visible outbound requests are limited to repository metadata for a star count display and feature-related calls. No API keys, tokens, or private chat content are observed leaving the host in the provided evidence.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.credential-to-network
- File role
- production
- Source
- index.js:228-1897
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
A security scanner thought this code might be deliberately hidden or scrambled, but it's actually normal, readable JavaScript that explains what it does in comments.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: JS-X-Ray flagged line 1 with a low-confidence 'obfuscated-code' signal, but the file contains no obfuscation. The flagged location is a standard JSDoc comment block documenting the parser module. The source code is plain, readable JavaScript with clear comments and standard patterns. The scanner likely misidentified the presence of regular expressions or string patterns as obfuscation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/systems/generation/parser.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
A security scanner thought line 96 might contain a suspicious link, but it's actually just counting how much text is in an image URL for debugging - no data is sent anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: JS-X-Ray flagged line 96 with a 'shady-link' signal, but the code at that line is a standard data URL byte-length calculation (url.startsWith('data:') && comma !== -1). No network access, request construction, or suspicious URL is present. The function is used solely to estimate the size of inline base64 image data for debug logging purposes. The scanner signal is a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/systems/generation/inspector.js:96
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This file lets you view and edit hidden tracker data from AI messages. The security scanner's alert was a false alarm—the code is clear and does exactly what it's supposed to.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The JS-X-Ray obfuscated-code signal is a false positive. The source code in trackerJsonInline.js is clean, readable, and well-documented. It implements inline collapsible tracker data dropdowns with an edit feature that parses JSON and writes back to the message store. No obfuscation, concealed execution, or malicious data flows are present. The code uses escapeHtml for any user-facing output and handles JSON parsing safely with try-catch. The scanner likely triggered on the template literal HTML or the JSON.stringify/parse pattern, but this is standard JavaScript.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/systems/rendering/trackerJsonInline.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · low confidence
This code manages a lorebook editor and is written in a clear, readable way. The security alert is a mistake—there's no hidden or malicious code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The JS-X-Ray obfuscated-code signal is a false positive. The full source code is well-structured JavaScript with descriptive comments, constants for icons and colors, and standard async/await patterns for loading lorebook data. No obfuscation, concealed logic, or credential manipulation is present. The scanner likely flagged the use of dynamic HTML construction with template literals, which is typical for UI rendering extensions.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/systems/rendering/lorebook.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This file looks normal and does what it says—it shows character thoughts on screen. The security scanner had a false alarm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The JS-X-Ray obfuscated-code signal is a false positive. The source code in thoughts.js is fully readable, well-commented, and contains no obfuscation, concealed execution, or suspicious data flows. The static analysis heuristic likely triggered on regular expressions or complex string operations used for parsing AI-generated character data. The code performs expected UI rendering tasks for a SillyTavern extension (character thought bubbles, card flips, avatar uploads, etc.) and uses proper escaping (escapeHtml, escapeAttr) when inserting into the DOM. No security concern exists.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/systems/rendering/thoughts.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · low confidence
This file looks like normal, clean code for displaying a status panel. The security scanner flagged it by mistake; there's nothing hidden or suspicious here.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The JS-X-Ray obfuscated-code signal is a false positive. The full source code shows standard JavaScript with clear comments, meaningful variable names, and straightforward DOM manipulation for rendering an info box dashboard. No obfuscation, concealed execution, or credential handling is present. The scanner likely flagged dynamic string building or use of escapeHtml/escapeAttr helpers, which are legitimate UI rendering patterns.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/systems/rendering/infoBox.js:1
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · high confidence
This code has a list of dangerous property names (like '__proto__') that it blocks to prevent a type of security attack called prototype pollution. It's actually protecting you, not doing anything harmful. The security alert is a false alarm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution in this repository.
Contextual assessment: The 'prototype-pollution' signal at line 12 is triggered by the `__proto__` string inside the `BLOCKED_PROPERTY_NAMES` array. This array is used defensively in `sanitizeLocationName()` and `validateStoredInventory()` to reject dangerous object keys and prevent prototype pollution attacks. The code is actively mitigating the vulnerability, not committing it. The scanner signal is a false positive on a mitigation constant.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.prototype-pollution
- File role
- production
- Source
- src/utils/security.js:12
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The scanner flagged a line that checks if an image is a data URL, which is just a normal part of displaying pictures. This is an inspection tool that shows you what's happening, not anything shady.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The 'shady-link' signal at line 174 corresponds to a benign check of whether a data URL starts with 'data:' for display purposes. The code uses proper escaping via escapeAttr when injecting into HTML. This is an inspector/debug modal that shows the user what portrait attachments are queued; there is no suspicious external link or data exfiltration.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/systems/ui/inspectorModal.js:174
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This file is just a normal settings popup — no hidden or tricky code was found. The security scanner flagged it by mistake because it looks clean and readable.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The flagged file (modals.js) contains standard, well-commented ES6 class definitions for modal management (SettingsModal) and associated event handlers. No obfuscation, encoded strings, or concealed execution paths are present in the supplied source. The scanner signal is a low-confidence false positive; the code is plain and maintainable.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/systems/ui/modals.js:1
JavaScript analysis reported javascript.credential-to-network
Expected behavior · high confidence
This extension lets you use an external AI service for some features. It takes the API key you provided (stored securely) and sends it only to the AI service you chose. This is how it is supposed to work.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.credential-to-network in this repository.
Contextual assessment: The extension retrieves an API key from a secure storage mechanism (REDACTED_SECRET) and sends it only to the user-configured OpenAI-compatible API endpoint as an Authorization header. This is the intended behavior for the 'external' generation mode, which makes a separate API call to generate RPG tracker data. The destination is the baseUrl set by the user; there is no exfiltration to third-party hosts.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.credential-to-network
- File role
- production
- Source
- src/systems/generation/apiClient.js:49-68
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This file looked suspicious to an automated scanner, but looking at the actual code shows it is perfectly normal. It parses character sheet data from chat messages and manages popup displays — nothing hidden or dangerous.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The JS-X-Ray obfuscated-code signal is a false positive. The supplied source code for characterSheet.js is fully readable, well-commented, and follows a clear, intentional structure. No obfuscation, minification, or concealed execution is present. The scanner likely triggered on regex patterns or escape sequences in string literals (common in parsing code), but these are legitimate and necessary for the sheet-parser functionality. The code only performs local UI operations, chat-data parsing, and settings persistence via standard SillyTavern APIs.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/systems/ui/characterSheet.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
A security scanner thought this code might be deliberately hidden or scrambled, but it's actually normal, readable JavaScript that explains what it does in comments.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: JS-X-Ray flagged line 1 with a low-confidence 'obfuscated-code' signal, but the file contains no obfuscation. The flagged location is a standard JSDoc comment block documenting the integration module. The source code is plain, readable JavaScript with clear comments and standard event-handling patterns. The scanner likely misidentified the presence of regular expressions or string patterns as obfuscation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/systems/integration/sillytavern.js:1