The flagged link is just the default local address for a user's own ComfyUI image-generation program running on their machine. This is clearly documented in the project's setup guide and is a normal configuration value, not a suspicious external connection.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
The scanner noticed both network calls and dynamic code loading in the same file. However, the network calls go to SillyTavern's own local API for testing image generation and auditing files, and the dynamic imports load fixed internal module files — none of this is controlled by outside input. This is standard, safe behavior for a settings panel.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
The scanner saw a network call and a code-execution-like pattern in the same area. The network call sends delete requests to SillyTavern's own API to remove orphaned image files the user selected, and the code pattern is just a timer for setting up a checkbox. No outside data reaches any dangerous operation. This is a normal file-cleanup feature.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlated a fetch call to '/api/backgrounds/delete' (line 88) with a setTimeout callback (line 69) as a network-retrieval-plus-execution-sink pattern. In reality, the setTimeout merely binds a jQuery 'change' event handler to a select-all checkbox — it is a standard UI wiring pattern, not a dynamic code execution sink. The fetch call posts to SillyTavern's local backgrounds delete API with a filename payload that the user explicitly selected from a list of orphaned images. Filenames are HTML-escaped via escapeHtml() before being rendered in the DOM (lines 42-44), and the selected values are read back from checkbox elements before being sent as JSON. No untrusted external input flows into any execution sink. The entire flow is user-initiated cleanup of orphaned background images, matching the project's stated purpose.