The scanner saw a URL read and an HTML-writing operation in the same file and flagged it as suspicious. In reality, the code reads a script tag's path to find its own folder and writes a fixed settings menu template. Neither piece involves downloading and running external code, and no user or network data enters the HTML template.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner rule javascript.download-to-execution correlates a network-retrieval primitive with a code execution sink in the same file. In this code, the only URL-related operation is reading script.src attributes via querySelectorAll to derive BASE_URL for the extension's own static assets; there is no fetch, XMLHttpRequest, dynamic import, or eval. The innerHTML assignment in createThemeModal uses a hardcoded template literal containing only static HTML markup with no interpolation of external or user-controlled data. No download-to-execute data flow exists. The file is a self-contained UI extension that manipulates DOM, reads CSS variables for theming, and persists settings via SillyTavern's context API, all consistent with its stated purpose as an animated status bar extension.
Impact: none · Exploitability: unlikely
Developer action: No action required. The innerHTML template is static; no untrusted or network-retrieved data flows into it.
The extension builds its settings dialog by writing a fixed block of HTML into the page. Because no outside or user-typed data is inserted into that HTML, there is no injection risk. This is a normal way for browser extensions to create their UI.
Technical assessment
createThemeModal assigns a static template literal to overlay.innerHTML. The template contains only fixed HTML elements, Font Awesome icon classes, and placeholder text with no dynamic interpolation. No user input or network-retrieved data flows into this innerHTML sink, so there is no demonstrated HTML injection or code execution path.
Impact: none · Exploitability: unlikely
Developer action: No action needed for the current static template. If dynamic values are ever added to this innerHTML, sanitize or use textContent/element construction to prevent HTML injection.