The extension talks to a local memory service running on your own computer, using a standard address that is normal for this kind of tool.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The extension stores a default sidecar URL pointing to localhost port 8765, which is used to communicate with a local woven-imprint sidecar process. This URL is hardcoded but is the intended and documented address for the sidecar, and users can change it via settings.
The plugin reads a setting from your computer's environment to know where the memory service is running, which is a normal way to configure server tools.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The server plugin reads the WOVEN_IMPRINT_URL environment variable to locate the sidecar, falling back to localhost. Reading an environment variable is standard configuration practice and is not credential theft; the value is used solely for proxying requests.
The plugin has a standard local address for the memory service, which is expected and safe because it only connects to your own computer.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The server plugin defines a default sidecar URL pointing to localhost port 8765. This URL matches the documented sidecar address and is used to forward requests from the UI extension to the memory service. It is not a suspicious external link.
The extension fetches memories from your local memory service and adds them to the chat prompt as plain text, just like other memory tools do.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: The extension uses fetch to retrieve memory context from the sidecar and passes the returned text into the SillyTavern extension prompt API. There is no eval, dynamic require, or command execution; the data is used only as prompt text.