No material or immediate-danger item was identified.
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- smart-context.js:156
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- tree-store.js:802
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- summary-hierarchy.js:131
Contextual expected matches (8)
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
The scanner thought it saw hidden or scrambled code, but the actual file is plain, readable JavaScript with clear comments. It counts messages and triggers summaries at regular intervals, all within the extension's normal purpose. Nothing is concealed.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged an obfuscated-code signal at low confidence, but the supplied source is fully readable, well-commented JavaScript with no minification, encoding, eval chains, or concealment. The module tracks message counts per chat, persists counters to chat metadata, and triggers summaries via runSummary at configured intervals. It reads from SillyTavern context, writes counters to chatMetadata via saveMetadataDebounced, and clears extension prompts. All data flows remain within the extension and SillyTavern host context. No network calls, credential access, or hidden execution paths are present. The signal is a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- auto-summary.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
The scanner thought it saw hidden code, but this is clearly readable, well-documented JavaScript. It sends chat context to a secondary AI model to decide what lorebook entries to create or update, which is exactly what the extension is designed to do. Nothing is concealed or sent to unexpected places.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged an obfuscated-code signal at low confidence, but the supplied source is transparent, heavily commented JavaScript. The module implements the sidecar post-generation writer described in the README: it fires on MESSAGE_RECEIVED, builds context from the chat and lorebook tree, sends it to the sidecar LLM via sidecarGenerate, parses structured JSON responses, and executes write operations (remember, update, merge, forget, summarize, reorganize) on lorebooks. Data flows to the user-configured sidecar/analytical LLM connection, which is the extension's stated purpose. Snapshot and revert logic stores entry states in chatMetadata for undo support. All lorebook writes go through standard SillyTavern APIs (loadWorldInfo, saveWorldInfo, deleteWorldInfoEntry). No credential exfiltration, hidden destinations, or obfuscation are present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- sidecar-writer.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
A security scanner noticed a web link in this test file, but it is just a fake localhost address used to test how the extension handles local AI servers. No real internet connection happens during these tests.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The scanner flagged a shady-link signal at line 77, but the referenced line is a test case setting a mock profile with a localhost endpoint URL. This is a vitest test file where all network access is mocked via vi.stubGlobal('fetch', ...). No real network request is made. The localhost URL is a legitimate test fixture for verifying local-sidecar configuration handling, consistent with the project's stated purpose of supporting local LLM endpoints.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- test
- Source
- tests/llm-sidecar.test.js:77
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
The scanner thought this file might contain hidden or disguised code, but the actual code is fully readable, well-documented, and straightforward. It creates and manages scene summaries in the user's lorebook using normal SillyTavern features. There is nothing hidden or suspicious here.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The supplied source is transparent, well-commented production JavaScript for a SillyTavern summarization tool. It uses clear identifiers, extensive JSDoc, straightforward control flow, and named imports from sibling modules. There is no minification, encoding, eval chains, string assembly, or concealment. The scanner flagged obfuscation with low confidence at the file header, but the actual code shows no obfuscation whatsoever. All data flows are local: reading chat metadata, creating lorebook entries, and hiding summarized chat messages via standard SillyTavern APIs. No external destinations, credential access, or hidden execution are present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- tools/summarize.js:1
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The scanner worried that a pattern-matching expression used in the project's automated tests could be tricked into running very slowly and freezing the app. Reading the actual expression, it simply checks whether a short lorebook entry title starts with a bracketed summary marker, and its construction cannot blow up on any realistic input. It also only executes when a developer runs the test suite, never when a user installs or uses the extension. There is nothing here that can harm users.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The flagged line sits inside a mocked module definition in a unit test file; it simulates the project's summary-title detector for lorebook entry comments and runs only under the developer test runner, not in the shipped extension runtime. The flagged regular expression is anchored at the start of the input, matches a literal opening bracket, then an optional word chosen from three alternatives each followed by whitespace, then the literal word summary, case-insensitively. The alternation branches begin with distinct literal prefixes and contain only single-level quantifiers, so there is no overlapping or nested ambiguity that could cause exponential backtracking; matching cost stays linear in the length of the input. The input is a short lorebook entry title string that is coerced and trimmed before testing. The static heuristic appears to be reacting to quantifier nesting depth rather than any demonstrable denial-of-service condition, and even a worst-case slowdown on a title string would be a recoverable local self-denial-of-service, which the threat model treats as low. No untrusted-input path, attacker-controlled trigger, or concrete user harm is demonstrated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- test
- Source
- tests/tree-builder.test.js:117
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
The scanner thought it saw hidden code, but this is plain, well-commented JavaScript that collapses summarized messages in the chat view with toggle buttons. It only changes what you see on screen and does not send data anywhere or access any credentials.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged an obfuscated-code signal at low confidence, but the source is fully readable JavaScript with extensive documentation. The module manages UI collapse of summarized chat messages: it injects a CSS style element, toggles CSS classes on DOM message elements, posts summary markers as system messages, and reconciles the DOM with chat state via a 2-second interval. All operations are local DOM manipulation within SillyTavern's chat view. No network calls, credential access, external destinations, or obfuscation are present. The setInterval timer is a lightweight DOM reconciliation appropriate for the UI feature.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- summary-collapse.js:1
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
A security scanner flagged a regular expression in this test file as potentially unsafe, but the pattern is simple and only used to match short text labels like [Summary] in tests. There is no risk of it causing performance problems.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The scanner flagged an unsafe-regex signal at line 38. The referenced line is a vi.fn mock stub containing the regex /^\[(?:scene\s+|act\s+|story\s+)?summary/i used to test summary title detection. This regex has no nested quantifiers or catastrophic backtracking patterns, so it is not vulnerable to ReDoS. It operates only on short title strings within a test mock and has no runtime exposure in shipped code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- test
- Source
- tests/summary-hierarchy.test.js:38
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
The scanner thought it saw hidden code, but this is clearly readable JavaScript with detailed comments. It collects recent chat messages, sends them to an AI model to produce a summary, saves the summary as a lorebook entry, and optionally hides the original messages. This is exactly what the extension is designed to do. Nothing is hidden or sent to unexpected places.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged an obfuscated-code signal at low confidence, but the source is fully readable, thoroughly commented JavaScript. The module implements the shared summarization runner: it collects a chat message window, builds a prompt, sends it to generateAnalytical (the analytical/sidecar connection), leniently parses JSON from the model response, creates a lorebook entry via createEntry, optionally hides the summarized message range, and posts a summary marker. All data flows to the user-configured analytical LLM connection, which matches the extension's stated purpose. The lenient JSON parser strips markdown fences and attempts extraction, which is a standard robustness pattern for LLM output handling, not obfuscation. No credential access, hidden destinations, or concealed execution are present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- summary-runner.js:1