A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The scanner flagged a line that checks for 'data:' at the start of streamed response lines. This is how all streaming AI APIs format their output, not a suspicious link. The extension sends data only to endpoints the user configures.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The scanner flagged line 559 (`if (!trimmed || !trimmed.startsWith('data:')) continue;`) as a shady-link signal. In context, this is standard Server-Sent Events (SSE) stream parsing for an OpenAI-compatible API response. The `data:` prefix is the SSE protocol line delimiter, not a URL or external link. The surrounding code reads streaming chunks from a user-configured OpenAI-compatible endpoint, parses JSON deltas, and assembles the response content. All network destinations in this file are user-configured: the Ollama URL, the OpenAI-compatible URL, or SillyTavern's built-in APIs (generateRaw, ConnectionManagerRequestService, CORS proxy). The API key is sent only as a Bearer token to the user-specified endpoint. No hardcoded third-party destinations, no credential exfiltration, no concealed network calls.
The scanner flagged possible code obfuscation, but the source code is fully readable JavaScript with clear variable names, comments, and standard patterns. There is nothing hidden or obfuscated.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged line 1 (the file header comment) with low confidence for obfuscated-code. Reviewing the full source, file is plain, readable JavaScript with descriptive variable names, extensive comments, standard ES module imports, and no minification, encoding, eval, or string-concatenation tricks. The code defines settings, prompt presets, retry logic, and UI event handlers in a straightforward manner. There is no obfuscation present.
This is a memory and summarization extension for SillyTavern. It calls the AI model to create summaries of chat history and then inserts those summaries into the conversation context. The scanner flagged that the code both makes network calls and manipulates runtime behavior, but these are the extension's intended and visible features — it asks the AI for summaries and injects the results into the prompt. No hidden code downloads or secret execution were found.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlates a network retrieval primitive with a dynamic execution sink in the same code region. Examining the supplied source, the visible code performs standard SillyTavern extension operations: calling setExtensionPrompt to inject summary text into the generation context, registering slash commands (sc-status, sc-clear, sc-preview) that operate on local chat metadata, jQuery-based DOM updates for the settings UI, and event handlers (onMessageReceived, onChatChanged, onGenerationStarted). The referenced callSummarizer function (not fully shown but implied by project purpose) makes LLM API calls through the SillyTavern framework to generate summaries, and the results are injected via setExtensionPrompt — this is the stated core purpose of the extension. The executeSlashCommandsWithOptions call uses a fixed /unhide command with a numeric loop index, not attacker-controlled input. DOM updates via jQuery .html() use escapeHtml() for user content and numeric values for metadata. No evidence of fetching remote code and dynamically executing it (e.g., eval of fetched data, dynamic script injection from external URLs) was found in the supplied code. The correlation between LLM
The scanner flagged references to a localhost URL. This is the default address for Ollama, a common local AI tool. The user can change it, and the extension only connects to whatever address the user configures.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
setExtensionPrompt used for summary injection as designed
low risk · high confidence
The extension uses standard SillyTavern APIs to inject summary text into the AI's context window. This is exactly what a memory extension is supposed to do.
Technical assessment
The updateInjection function uses setExtensionPrompt from the SillyTavern context API to inject assembled summary blocks into the chat context at a specified depth. This is the standard, documented mechanism for SillyTavern extensions to contribute prompt content. The injected text is the extension's summary output, which matches the project's stated purpose of layered memory summarization.