A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The flagged links are all expected for this extension: calls to the local SillyTavern server to save images, references to its own error icons, and handling of image URLs returned by the user's chosen image-generation API. Nothing sends data to unexpected or hidden places.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The scanner flagged 12 shady-link occurrences near line 3226. The supplied context shows the links are: local SillyTavern API endpoints such as /api/images/upload, /api/images/delete, and /api/files/upload for saving and deleting generated media on the ST server; relative legacy error-image paths under /scripts/extensions/third-party/; and references to external HTTPS URLs returned by image-generation providers (DALL-E, proxies) that the extension converts to data URLs. All of these are proportionate to the stated purpose of an inline image-generation extension that calls user-configured model-provider APIs and persists results locally. No hidden destinations, credential exfiltration, or undisclosed network calls are visible in the data flow.
The code is fully human-readable and well-documented. There is no hidden or scrambled code despite the scanner flagging it.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged an obfuscated-code signal at line 1, but the supplied source is plainly readable JavaScript with clear variable names, detailed inline comments, standard IIFE structure, and no encoding, packing, or string-hiding. The signal is a false positive, likely triggered by the large single-file module pattern or Unicode characters in comments. No obfuscation or concealed execution is present.