No material or immediate-danger item was identified.
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- smart-context.js:156
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- tree-store.js:785
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- summary-hierarchy.js:131
Contextual expected matches (8)
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
The scanner thought it saw hidden or scrambled code, but the actual file is plain, readable JavaScript with clear comments. It counts messages and triggers summaries at regular intervals, all within the extension's normal purpose. Nothing is concealed.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged an obfuscated-code signal at low confidence, but the supplied source is fully readable, well-commented JavaScript with no minification, encoding, eval chains, or concealment. The module tracks message counts per chat, persists counters to chat metadata, and triggers summaries via runSummary at configured intervals. It reads from SillyTavern context, writes counters to chatMetadata via saveMetadataDebounced, and clears extension prompts. All data flows remain within the extension and SillyTavern host context. No network calls, credential access, or hidden execution paths are present. The signal is a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- auto-summary.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
The scanner thought it saw hidden code, but this is clearly readable, well-documented JavaScript. It sends chat context to a secondary AI model to decide what lorebook entries to create or update, which is exactly what the extension is designed to do. Nothing is concealed or sent to unexpected places.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged an obfuscated-code signal at low confidence, but the supplied source is transparent, heavily commented JavaScript. The module implements the sidecar post-generation writer described in the README: it fires on MESSAGE_RECEIVED, builds context from the chat and lorebook tree, sends it to the sidecar LLM via sidecarGenerate, parses structured JSON responses, and executes write operations (remember, update, merge, forget, summarize, reorganize) on lorebooks. Data flows to the user-configured sidecar/analytical LLM connection, which is the extension's stated purpose. Snapshot and revert logic stores entry states in chatMetadata for undo support. All lorebook writes go through standard SillyTavern APIs (loadWorldInfo, saveWorldInfo, deleteWorldInfoEntry). No credential exfiltration, hidden destinations, or obfuscation are present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- sidecar-writer.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
A security scanner noticed a web link in this test file, but it is just a fake localhost address used to test how the extension handles local AI servers. No real internet connection happens during these tests.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The scanner flagged a shady-link signal at line 77, but the referenced line is a test case setting a mock profile with a localhost endpoint URL. This is a vitest test file where all network access is mocked via vi.stubGlobal('fetch', ...). No real network request is made. The localhost URL is a legitimate test fixture for verifying local-sidecar configuration handling, consistent with the project's stated purpose of supporting local LLM endpoints.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- test
- Source
- tests/llm-sidecar.test.js:77
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
The scanner thought this file might contain hidden or disguised code, but the actual code is fully readable, well-documented, and straightforward. It creates and manages scene summaries in the user's lorebook using normal SillyTavern features. There is nothing hidden or suspicious here.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The supplied source is transparent, well-commented production JavaScript for a SillyTavern summarization tool. It uses clear identifiers, extensive JSDoc, straightforward control flow, and named imports from sibling modules. There is no minification, encoding, eval chains, string assembly, or concealment. The scanner flagged obfuscation with low confidence at the file header, but the actual code shows no obfuscation whatsoever. All data flows are local: reading chat metadata, creating lorebook entries, and hiding summarized chat messages via standard SillyTavern APIs. No external destinations, credential access, or hidden execution are present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- tools/summarize.js:1
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
A pattern-matching rule in a test file checks whether an entry title starts with a summary tag like [Summary]. The pattern is simple and fast with no risk of causing freezes or crashes. This is normal test code with no security concern.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The flagged regex is a simple anchored pattern with one optional non-capturing alternation and no nested quantifiers. It matches bracketed summary-title prefixes and has no catastrophic-backtracking or ReDoS surface. It appears inside a vitest mock for a tree-store module and is not shipped production code. No attacker-controlled input reaches it in a way that could cause meaningful harm.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- test
- Source
- tests/tree-builder.test.js:117
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
The scanner thought it saw hidden code, but this is plain, well-commented JavaScript that collapses summarized messages in the chat view with toggle buttons. It only changes what you see on screen and does not send data anywhere or access any credentials.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged an obfuscated-code signal at low confidence, but the source is fully readable JavaScript with extensive documentation. The module manages UI collapse of summarized chat messages: it injects a CSS style element, toggles CSS classes on DOM message elements, posts summary markers as system messages, and reconciles the DOM with chat state via a 2-second interval. All operations are local DOM manipulation within SillyTavern's chat view. No network calls, credential access, external destinations, or obfuscation are present. The setInterval timer is a lightweight DOM reconciliation appropriate for the UI feature.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- summary-collapse.js:1
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
A security scanner flagged a regular expression in this test file as potentially unsafe, but the pattern is simple and only used to match short text labels like [Summary] in tests. There is no risk of it causing performance problems.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The scanner flagged an unsafe-regex signal at line 38. The referenced line is a vi.fn mock stub containing the regex /^\[(?:scene\s+|act\s+|story\s+)?summary/i used to test summary title detection. This regex has no nested quantifiers or catastrophic backtracking patterns, so it is not vulnerable to ReDoS. It operates only on short title strings within a test mock and has no runtime exposure in shipped code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- test
- Source
- tests/summary-hierarchy.test.js:38
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
The scanner thought it saw hidden code, but this is clearly readable JavaScript with detailed comments. It collects recent chat messages, sends them to an AI model to produce a summary, saves the summary as a lorebook entry, and optionally hides the original messages. This is exactly what the extension is designed to do. Nothing is hidden or sent to unexpected places.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged an obfuscated-code signal at low confidence, but the source is fully readable, thoroughly commented JavaScript. The module implements the shared summarization runner: it collects a chat message window, builds a prompt, sends it to generateAnalytical (the analytical/sidecar connection), leniently parses JSON from the model response, creates a lorebook entry via createEntry, optionally hides the summarized message range, and posts a summary marker. All data flows to the user-configured analytical LLM connection, which matches the extension's stated purpose. The lenient JSON parser strips markdown fences and attempts extraction, which is a standard robustness pattern for LLM output handling, not obfuscation. No credential access, hidden destinations, or concealed execution are present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- summary-runner.js:1