Several regular expressions in the prompt-building code could slow down or freeze the browser if fed specially crafted input. The input comes from lore modules the user loaded and from character card text, so exploitation would require a malicious lore module or crafted card content. The worst case is a frozen browser tab, not data loss or theft.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: low · Exploitability: unlikely
Developer action: Consider anchoring regex patterns derived from lore-engine data (pending.cardStripPatterns, pending.stripWords) by escaping user-supplied metacharacters before passing them to new RegExp, and add a length cap or timeout guard on the multi-line block-matching regexes to prevent pathological backtracking on large card content.
This extension is designed to load and run JavaScript lore modules from the internet or from the SillyTavern server. That is its core feature, clearly documented in the README. The code does exactly what it says: fetches a JS file and runs it as a module. There is no hidden execution or credential theft.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner flags co-located network retrieval (fetch) and dynamic code execution (import()). The extension's stated purpose is a programmable lore engine that loads JS modules implementing processTurn()/handleResponse(). loadLoreFromUrl fetches JS source from a user-provided URL and passes it to loadLoreFromSource, which creates a Blob, generates an object URL, and calls import() to execute it. The fetch('/api/files/upload') calls upload debug sidecar files and lore modules to the local ST server. All network destinations are either the user-provided lore URL (GitHub raw, documented), the local ST server API endpoints, or stored server paths for cross-device sync. No credentials, API keys, or private content are sent to external destinations. The auto-update feature polls a version.json and downloads updated lore modules, which is documented in the README. This data flow is proportional to and directly implements the stated project purpose.