No material or immediate-danger concern was identified in this review.
This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.
0 immediate danger
0 material
1 low
What this review found
No material or immediate-danger item was identified.
Contextual expected matches (1)
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
This extension is designed to run small game-logic scripts (called lore modules) that the user themselves imports, and that design is explained openly in the project's documentation. The flagged network call actually just saves debugging information to the user's own SillyTavern server so chat files stay small. There is no sign of hidden downloads, secret destinations, or code running that the user did not choose to install.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
Scanner javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule javascript.download-to-execution
File role production
Source core.js:87-212
Coverage and limitations
Inventory 17 files · 946010 bytes
Contextual coverage 1 of 1 candidates assessed
JavaScript coverage
Status Incomplete
Candidates 4 files · 162006 bytes
X-Ray review families 0 warning occurrences compacted to 0 evidence-preserving review families
Representations 4 raw · 1 decoded · 0 normalized · 0 bundle modules
Stage scans 4 raw signatures · 4 raw AST · 4 raw OpenGrep · 1 derived signatures · 0 derived AST · 1 derived OpenGrep
Unresolved JavaScript stages core.js — derived-ast / parsecore.js — normalize / parseTools
Limitations
This advisory review cannot prove the absence of unknown behavior. JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.
Technical scan identity
Full commit b03dac39fd82d75bc1a3f17f4f0b23e956838946 Completed Sep 19, 2026 History depth 6 commits
Method Deterministic evidence with contextual review
Reviewer nano-gpt.com · zai-org/glm-latest
Scanner 0.1.0
Scanner policy 5
Rule catalog 2
Contextual policy 5
Ecosystem context sillytavern-community-v1
Prompt contextual-review-v7
Assessment schema contextual-assessment-v2
Review provenance 1 fresh / 0 reused groups · 1 fresh / 0 reused candidates
Review source reports none
Evidence triage 0 deterministic / 1 contextual candidates · 1 contextual / 1 total behavior cases
Model budget 1 model call · 1 / 12 fresh cases · 27339 / 200000 estimated input · 19393 / 250000 actual input · 961 / 40000 output tokens
Review batching 1 model call · up to 1 groups and 1 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage 19393 input · 961 output · 10 cache read · 437 reasoning tokens
Report b8da7443472ac9f4f6685e660af9f9b1923a51a7356e53c136ff9cbae8daa9f6