No material or immediate-danger item was identified.
Expected scanner matches (15)
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
Detailed wording was omitted by the public report safety filter.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:3884
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The scanner flagged this line because it saw a data-URI string pattern. In reality, the code is just checking whether an NPC profile picture is stored as an embedded image before sending it to the AI. This is normal behavior for an extension that manages NPC portraits.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged line checks whether an NPC profile picture field (n.pfp) starts with the data URI prefix 'data:image'. This is a standard guard to identify base64-encoded inline image data before pushing it into activeNpcImages for portrait injection. No external URL, network destination, or suspicious link is constructed or accessed. The signal is a false positive from the scanner matching on the data-URI literal. The surrounding code builds an XML NPC list and optionally attaches portrait images, consistent with the extension's stated NPC Bank and image-generation features.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:9230
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The code checks whether certain image files exist inside the extension's own folder and then uses that information to pick a random default image. There is no downloading of remote code and no running of downloaded code. The rest of the code manages the extension's settings, user interface, and text cleanup. This is normal behavior for a SillyTavern extension.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: The flagged range contains a fetch call in discoverDefaultImages() that issues HEAD requests to the extension's own local image directory to count available default images. No dynamic code execution sink (eval, Function constructor, script injection, command execution) is present in this range. The remaining code performs regex-based text cleaning, jQuery DOM manipulation for UI tab rendering, profile persistence via SillyTavern's extension_settings and chat_metadata APIs, and token estimation. The scanner correlated a network primitive with an inferred execution sink, but the actual data flow shows only local asset discovery and standard extension UI/state management.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- index.js:855-1262
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This code lets the user download their banned-phrases list as a JSON file. It works entirely within the browser by creating a downloadable file from the user's own data. Nothing is sent anywhere, and no external website is contacted.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged line constructs a data URI for a client-side file download of the user's ban list. The code serializes a local profile array into JSON, encodes it into a data URI, creates a temporary anchor element with a download attribute, triggers a click, and removes the element. This is a standard browser pattern for exporting user data to a file. No network request is made, no external destination is contacted, and the data stays entirely on the user's machine. The data URI scheme is used for local file generation, not for obfuscation or exfiltration.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:3082
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The extension checks whether its own bundled image files exist by looking for them in its local folder. It does not download anything from the internet and does not run any code based on what it finds. This is normal behavior for an extension that displays images.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: The flagged range contains a fetch call in discoverDefaultImages that issues HEAD requests to local extension image assets (default1.png through default20.png) to count available bundled images. The destination is the extension's own local folder, not an external or attacker-controlled endpoint. No data from the network response is passed into eval, Function, exec, or any other dynamic code execution sink. The only other dynamic constructs in the range are RegExp objects built from escapeRegex-sanitized NPC names for text matching during pruning, which is text processing, not code execution. There is no download-to-execution data flow present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- index.js:1010-1475
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The code is simply checking whether a character's profile picture is stored as an inline image. If it is, the picture may be sent to the AI as part of the conversation context, but only if the user has enabled that option. There is no suspicious link or hidden network activity here.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged line checks whether an NPC profile picture field (n.pfp) begins with the data:image prefix, indicating a base64-encoded inline image. If true, the image is added to an activeNpcImages array for potential inclusion in AI prompt context, gated behind a user-facing setting (sendPortraitsToAi). No external URL, network destination, or obfuscated endpoint is involved. The scanner's shady-link heuristic appears to have matched on the data: URI scheme, which is a standard browser pattern for inline image handling. This data flow is consistent with the project's stated NPC management and image generation features.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:7631
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This code lets users download a JSON file to their computer. It uses a standard browser technique where a temporary download link is created and clicked automatically. This is a normal way to save files in web-based extensions.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:4895
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
Detailed wording was omitted by the public report safety filter.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged line constructs a data URI with the text/json media type to serialize the local ban list as JSON for a client-side file download. An anchor element is created with a download attribute and programmatically clicked, which is a standard browser pattern for exporting user data without any network request. No remote destination, credential access, or exfiltration is involved. The data originates from local extension state and remains on the user's machine.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:3755
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This code lets the user download their custom engine settings as a JSON file. It takes the local configuration data, turns it into a downloadable file, and saves it to the user's device. Nothing is sent over the internet and no private information is involved.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:8087
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The flagged line is a simple text-cleanup step that collapses multiple blank lines into a standard double line break. The pattern is straightforward and does not create any performance or security risk.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The scanner flagged line 9504 as an unsafe regex. The actual regex is /(?:[newline][spaces]){3,}/g which collapses 3+ consecutive blank lines into a double line break. This pattern does not contain nested quantifiers, overlapping alternatives, or other ReDoS-prone constructs. Each iteration of the {3,} group consumes at least one newline character, making matching deterministic. The regex operates on chat message content as part of normal prompt preprocessing, which is expected for this extension's stated purpose of managing prompt payloads and text cleanup. No security risk is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:9504
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
The scanner thought the code might be hidden or scrambled, but the actual code is clearly written and easy to read. It is a normal SillyTavern extension with large text templates for story and image prompts. Nothing is concealed or disguised.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The scanner flagged an obfuscation signal on line 1, but the supplied source context shows plain, readable ES module code with standard SillyTavern extension imports, clear constant declarations, and large human-readable prompt template strings. No encoding, packing, string concealment, eval-based decoding, or control-flow flattening is present. The signal is a false positive, likely triggered by the volume of large string literals in prompt templates or a heuristic mismatch.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- index.js:1
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This line tidies up chat text by squashing excessive blank lines into a normal paragraph break. It is a routine text-cleanup step with no security risk.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged regex collapses three or more consecutive blank lines (with optional trailing whitespace) into a standard double line break within chat message content. The pattern is a simple quantified group with no nested alternation or overlapping quantifiers that could cause catastrophic backtracking. It operates on local chat message text as part of the extension's stated prompt-cleanup pipeline, which is consistent with the project's purpose of sanitizing and formatting prompt payloads before generation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:7903
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This is just a default local address for connecting to ComfyUI, a local image generation tool. The extension is supposed to talk to ComfyUI, so having this default is normal and expected.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged literal is a default configuration value for a ComfyUI integration endpoint, set to a loopback address on port 8188. The project's stated purpose explicitly includes ComfyUI image generation, and this value serves as the default connection target for that feature. It is a user-configurable default, not a hardcoded exfiltration destination or concealed network call.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:332
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
Detailed wording was omitted by the public report safety filter.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: Review the cited evidence and confirm the intended behavior.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:9703
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
The scanner flagged this file as potentially obfuscated, but the code is plain, readable JavaScript with clear comments. It simply uses regular expressions to find special formatted blocks in chat messages. There is no hidden or disguised code here.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The obfuscated-code scanner signal on line 1 corresponds to an eslint-disable comment. The entire file is plain, well-commented JavaScript defining regex patterns for extracting HTML details blocks from AI chat messages and helper functions to iterate chat arrays. No minified, encoded, or concealed logic is present. The regex patterns are readable and match the stated project purpose of parsing structured data from chat messages.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/sidepanel/parsers.js:1