No material or immediate-danger item was identified.
JavaScript analysis reported javascript.xray.obfuscated-code
Minor caution · low confidence
The scanner noticed a possible sign that some JavaScript may be harder to read, but the supplied evidence does not show what was matched or any harmful behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The candidate is a low-confidence obfuscation signal at the file start. The supplied source excerpt shows ordinary documented ES-module imports and summary-management logic, with no retained matched literals, execution sink, external destination, credential access, or concealment behavior. Obfuscation alone is insufficient to infer malicious intent, but unexplained obfuscation can reduce auditability; the file body and precise scanner match are needed for stronger assessment.
Impact: low · Exploitability: unlikely
Developer action: Provide the complete file or a scanner excerpt identifying the matched construct, then document or remove any unnecessary obfuscation.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- tools/summarize.js:1
Expected scanner matches (14)
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This is a test value for a local embedding service address. The test checks that the extension accepts local, keyless embedding setups; it does not show contact with an outside party or hidden behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The candidate is in a test file and concerns a localhost embedding endpoint used as fixture input. The supplied evidence shows no runtime request, credential transmission, persistence, or concealed destination; the behavior matches the documented embedding integration purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- test
- Source
- tests/llm-sidecar.test.js:489
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · medium confidence
This is a test using a local sidecar address. It checks that a locally hosted service can work without an API key, which matches the extension’s AI sidecar purpose.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The supplied context shows a test fixture for an enabled local endpoint and explicitly validates configuration handling. No execution, secret transmission, or concealed destination is shown at this candidate location; the scanner signal alone does not establish harmful network behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- test
- Source
- tests/llm-sidecar.test.js:155
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · medium confidence
This test checks that an enabled sidecar can be configured without an API key, for local services that do not require authentication. That is consistent with the documented feature.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The supplied source context is a unit test asserting configuration recognition for a loopback endpoint. It does not show data leaving the machine, credential collection, persistence, or hidden behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- test
- Source
- tests/llm-sidecar.test.js:80
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · low confidence
The available evidence only indicates that a scanner noticed possible code obfuscation. It does not show hidden behavior, stolen information, or an unusual destination. The visible file description matches an automatic summarization feature.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The candidate is based on a low-confidence obfuscation signal, while the supplied source excerpt shows ordinary ES module imports and event-handler initialization for message counting and prompt injection. The artifact and matched literals needed to substantiate concealed execution or harmful data flow were not supplied, so the signal does not establish a vulnerability or malicious behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- auto-summary.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · low confidence
The scanner found a possible obfuscation pattern, but the supplied evidence does not show what was obfuscated or that anything harmful happens.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The candidate is based on a low-confidence static obfuscation signal. The supplied source excerpt shows ordinary imports and documentation describing post-generation sidecar processing and lorebook writes, but it does not include the flagged construct, complete execution logic, data destinations, or evidence of concealed execution or credential handling. Obfuscation alone is insufficient to establish a security issue in this extension context.
Impact: none · Exploitability: unlikely
Developer action: Provide the unabridged JavaScript or a deobfuscated representation so the flagged construct, data flow, and destinations can be assessed.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- sidecar-writer.js:1
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The flagged pattern is used to recognize names and descriptive phrases in lorebook text so relevant story information can be selected. Nothing supplied shows attacker-controlled execution, secret handling, or external data transfer.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The reported unsafe-regex signal corresponds to a fixed regular expression used by deriveAliasKeys to extract role descriptors from the first sentence of an entry. In the supplied context it processes local lorebook content for alias generation; no external destination, code execution, credential access, or persistence is shown. The expression may have performance edge cases on specially crafted large inputs, but the evidence does not establish a practical denial-of-service condition.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- smart-context.js:155
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This is a fixed pattern used to recognize summary titles. It checks text supplied to the extension and does not itself access accounts, send data, or execute commands.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged expression is a bounded, anchored title-prefix matcher with a character-class exclusion that terminates at a closing bracket. The supplied evidence shows no attacker-controlled construction, repeated nested quantifiers, external side effect, or execution path; the operation is consistent with identifying summary entries in the extension's lorebook workflow.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- tree-store.js:785
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · medium confidence
This test verifies that an endpoint is rejected when it is missing. It is validation logic, not a suspicious link or an attempt to contact an outside service.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The candidate occurs in a test asserting false configuration status when the endpoint field is absent. The available evidence shows no network request, destination use, secret handling, or malicious execution.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- test
- Source
- tests/llm-sidecar.test.js:77
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · medium confidence
The flagged pattern removes an optional summary label from text before building a prompt. This is ordinary formatting for the extension’s scene-summary feature and does not show data theft or harmful execution.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The supplied context shows a fixed, anchored, case-insensitive regular expression applied to the comment field of lorebook entries. It strips an optional bracketed scene-summary prefix and then concatenates the result with entry content for an intended analytical language-model request. The expression is short, anchored, and structurally bounded, providing no demonstrated catastrophic backtracking, attacker-controlled execution, external transmission beyond the stated LLM workflow, or persistence behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- summary-hierarchy.js:131
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This is a simple case-insensitive pattern used by a test mock to recognize titles beginning with optional scene, act, or story labels followed by “summary.” It does not process attacker-controlled input in a dangerous operation or perform external actions.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged expression is a bounded, anchored recognizer with a small optional alternation and no nested unbounded quantifiers or overlapping repetition. It is used inside a mocked helper in a test file and only returns a boolean based on a supplied title. The evidence shows no catastrophic-backtracking path or security-sensitive sink.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- test
- Source
- tests/tree-builder.test.js:117
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · low confidence
The supplied evidence only reports a possible obfuscation pattern. The visible portion is ordinary, readable extension code and describes a user-interface feature for collapsing summarized chat messages; it does not show hidden execution, secret handling, or data transmission.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The scanner candidate is a low-confidence static obfuscation signal at the file start, while the supplied source excerpt contains descriptive comments, named constants, and standard SillyTavern imports. No obfuscated payload, dynamic evaluation, credential access, persistence, or external destination is shown. The evidence is limited to the supplied excerpt, so this assessment does not characterize omitted code beyond that evidence.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- summary-collapse.js:1
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · medium confidence
The flagged pattern is in a test file and is used to recognize summary titles. The supplied evidence does not show any user-controlled input, expensive repeated matching, or runtime security-sensitive behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The candidate identifies a regular expression in mocked test code. It is anchored at the beginning, uses a bounded optional alternation, and has no evident nested quantifiers or unbounded repetition. The file is a test fixture rather than shipped runtime logic, and the supplied context shows no attacker-controlled input or security-sensitive data flow.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- test
- Source
- tests/summary-hierarchy.test.js:38
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · low confidence
The scanner flagged possible obfuscation, but the supplied excerpt is readable, documented module code and does not show hidden behavior or concealed data handling.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The candidate contains only a low-confidence static obfuscation signal. The supplied source is ordinary, commented ES module code with named imports and a stated summarization purpose. No obfuscated payload, external destination, credential access, persistence, or concealed execution is evidenced. The excerpt does not provide enough implementation detail to independently validate every runtime operation, but it does not substantiate malicious behavior or a security weakness.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- summary-runner.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This is another test value for a local embedding service address. It is used to verify default settings, not to send information anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The candidate occurs in a unit-test fixture containing a localhost embedding endpoint. The supplied context shows only configuration and assertion logic, with no network execution or sensitive-data flow; local embedding support is consistent with the stated project purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- test
- Source
- tests/llm-sidecar.test.js:482