JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
A scanner thought part of the code looked suspiciously hard to read. Looking at the actual code, it is normal, readable code for an image-generation helper extension: it manages settings, finds image-prompt tags in chat replies, and builds interface elements. There is no hidden, scrambled, or sneaky code, and nothing sends data anywhere unexpected.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged an obfuscated-code signal at line 1 with low scanner confidence, and the matched literals were not retained. The supplied source context shows plain, readable, well-commented JavaScript: clear module imports from SillyTavern host APIs, descriptive constant and default-settings definitions, straightforward helper functions, and UI-rendering logic with HTML-escaped values. There is no string packing, character-code assembly, encoded payloads, concealed network endpoints, dynamic evaluation of untrusted input, or hidden execution timing. The regex-heavy tag-parsing and escaping code, along with compact one-liner formatting in later sections, is the most plausible source of a heuristic static-analysis false positive, but the behavior is consistent with the extension's stated purpose of detecting pic prompt tags and rewriting image-generation prompts. No credential handling, external destinations, or obfuscated data flow is present in the supplied evidence.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- index.js:1