A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
An automated scanner guessed the code might be deliberately hidden or scrambled, but it flagged this with low confidence and no specifics. Reading the actual file shows ordinary, well-commented extension code that does exactly what the project describes: watching chat replies for image-request tags and building image prompts. The warning was almost certainly caused by harmless escape sequences for symbols and by complex text-matching patterns, not by any real concealment or secret behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The static analyzer reported an obfuscation heuristic on this runtime entry file, but with low confidence and without retained matched literals. The supplied source context contradicts the signal: the file is plainly readable, heavily commented JavaScript that imports only documented SillyTavern extension APIs and manages configuration, UI state, and text-processing helpers consistent with the stated auto-image-generation purpose. The constructs most likely to trip the heuristic are unicode escape sequences for emoji characters in UI labels and dense regular-expression literals used to locate image-prompt tags, both benign and proportionate to the documented feature set. The evidence shows no encoded payloads, dynamic evaluation, hidden execution timing, disguised destinations, or behavior beyond the disclosed purpose.