The flagged link is used to create a clickable link in the image gallery that opens the generation history in the user's local ComfyUI software. This is a helpful UI feature that fits the extension's purpose. There is no security risk.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
The flagged link is just the default local address for the user's own ComfyUI image generation software. The extension needs this address to communicate with ComfyUI, which is exactly what the extension is designed to do. There is no security risk here.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
The extension uses network calls to talk to the user's local ComfyUI software and to load its own settings screen. This is normal and expected behavior for a SillyTavern extension. The code does not download and run untrusted scripts, so there is no security risk.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlated network retrieval with a code execution sink in the same file. The network retrieval consists of fetch calls to the user's configured ComfyUI host (localhost by default) to retrieve checkpoint lists, validate workflow files, and load settings HTML. The 'code execution sink' appears to be jQuery's $.get and .append() used to dynamically load and render the settings HTML from the extension's own folder. This is standard SillyTavern extension UI initialization and ComfyUI API communication, matching the project's stated purpose. No untrusted data is passed into eval or similar high-risk sinks.