No material or immediate-danger item was identified.
Contextual expected matches (39)
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · medium confidence
The security scanner thought this file might contain hidden code, but looking at the actual code, it's all readable and straightforward. There's nothing suspicious.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged this file for obfuscation, but the provided source shows standard, readable JavaScript with clear imports and well-documented functions. No obfuscation, encoded strings, or concealed execution paths are present. The signal is a false positive likely due to the static analysis heuristic.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- immersion.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This test file includes a fake image data URI to test how the extension handles images. It doesn't connect to any outside server. The scanner warning is a false positive.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Scanner flagged shady-link at line 39, but the value is a data URI 'data:image/png;base64,abc' used as a test fixture for multimodal content. No network access occurs; it is an inline image placeholder.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- test
- Source
- tests/cyoa-prompt-history.test.js:39
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The scanner noted a regex that could be unsafe if used on untrusted input, but here it's only used in a test to check the settings page HTML structure.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- test
- Source
- tests/settings-drawers.test.js:8
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
The scanner flagged some text in a test file that looks unusual, but it's just harmless placeholder markers used for testing a party-tracking feature.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner detected an 'obfuscated-code' signal on a test file containing inline rendering markers like ((BAR)). These markers are part of the D&D framework's UI rendering system and are used in test data to simulate party member headers. No actual obfuscation, concealed execution, or harmful behavior is present. The test file has no runtime impact on shipped extension behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- test
- Source
- tests/memo-processor-party-markers.test.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · low confidence
The scanner found something that might look suspicious, but the actual flagged text wasn't provided. The code around it just stores settings for AI services like Ollama and OpenAI, which is normal for this type of RPG tool. There's no evidence of harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: A static analysis scanner flagged a candidate as potentially containing a shady link, but the actual flagged literal was not retained in the evidence. The surrounding source code shows normal configuration fields for AI service endpoints such as Ollama and OpenAI URLs. These are expected for an extension that connects to external AI models for RPG features. Without the actual flagged value, there is no demonstrated security concern.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:2595
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
The code is clean and readable — no hidden tricks or secret behavior. A security tool flagged it incorrectly because it was too cautious.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- game-cartridges.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · medium confidence
A security scanner thought this file might have hidden code, but looking at the actual code shows it is normal, readable JavaScript for a game extension. No hidden or dangerous behavior is present.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The JS-X-Ray static analyzer flagged this file as potentially containing obfuscated code, but examination of the actual source reveals standard, readable JavaScript with no encoding, string concealment, or malicious patterns. The signal is a false positive, likely triggered by the presence of emoji characters and long template literals used for RPG game logic — common patterns in this SillyTavern D&D framework extension.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- character-creator.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This file helps developers debug the scheduler. It's written in clear, readable JavaScript and does not hide anything. The security scanner's warning is incorrect.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: JS-X-Ray flagged obfuscated-code on line 1, but the actual source is a well-documented debug instrumentation module with clear header comments, imports, and functions. There is no obfuscation, minification, or concealed logic. The scanner signal appears to be a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- swipe-scheduler-debug.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · medium confidence
A security scanner thought this file might have hidden code, but the actual code is just normal game constants and prompts. Nothing to worry about.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The JS-X-Ray static analyzer flagged this file as potentially containing obfuscated code, but examination of the actual source reveals standard, readable JavaScript with no encoding, string concealment, or malicious patterns. The file file consists entirely of exported constant definitions, template strings with emoji and game mechanics text, and a small function. The signal is a false positive — no obfuscation or harmful behavior exists.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- constants.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This code checks whether a portrait image is embedded as a data URL so it can be saved properly. It only talks to the SillyTavern server you are running, not to any outside site.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged line (59) is a simple type check and string prefix test ('data:image/') to identify embedded base64 portrait data URLs. This is used to decide whether to upload the image to SillyTavern's own image storage API. No external network destinations beyond the local ST server are involved. This is legitimate portrait management behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- portrait-storage.js:59
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
A scanner flagged a regular expression used in a test to check that damage dice descriptions are spelled out fully (not abbreviated) in the game's system prompts. The regex only runs on the project's own files, so there's no way for an attacker to exploit it.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The scanner flagged an 'unsafe-regex' signal at line 56 in this test file. The regex is `/\b\d+d\d+(?:[+-]\d+)?\s*[BPS]\b/i` used to detect abbreviated damage expressions like '3d8 B' in shipped system prompt files. The regex is applied only to static, project-owned text files read from disk. There is no user-controllable input or network data involved, and the regex is used solely for a test assertion. The signal is a false positive; no security concern.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- test
- Source
- tests/sysprompt-content.test.js:56
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This file was flagged as possibly obfuscated, but the actual code is clear and readable JavaScript that runs the game system wizard and settings panel. It's just normal code for the RPG framework, nothing hidden or suspicious.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner signal 'obfuscated-code' is a false positive. The file file contains extensive, well-commented JavaScript implementing a Game System Wizard, section management, and narrator configuration. All code is readable, purpose-driven, and proportional to the RPG framework's functionality. No obfuscation, concealed logic, or malicious behavior is observed in the supplied source.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- game-systems.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
A security scanner thought this file might contain hidden code, but looking at the actual code shows it is normal, readable JavaScript. It just builds HTML and handles game data, nothing suspicious.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The static scanner signal flagged the file as containing obfuscated JavaScript, but the supplied source text is entirely plain, readable JavaScript with standard imports, string manipulation, and HTML template generation. No encoded strings, dynamic code construction, or concealment techniques are present. The file's purpose—generating HTML strings and managing localStorage—matches the visible code. The scanner result is a false positive; no obfuscation is demonstrated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- renderer.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This is just a default address for a local AI program used to create character portraits. Nothing is being stolen or sent to an unexpected place.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged signal is a URL literal on line 385: the default local Ollama endpoint in getPortraitConnectionSettings. This function assembles connection settings for portrait-prompt LLM calls, which matches the project's stated AI Portrait Generation feature. The surrounding code passes user-configured provider settings, including an API key, to the project's own LLM client for generation requests; there is no evidence of exfiltration, unexpected destinations, or concealed behavior. The scanner labeled this 'shady-link' without retaining matched literals, and the visible code shows only a localhost default consistent with the extension's purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- portraits.js:385
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This file was flagged by an automated scanner as possibly containing obfuscated code, but looking at the actual code shows it's just normal, readable JavaScript that handles a settings popup for grouping modules. There's nothing hidden or suspicious.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner signal 'obfuscated-code' is a false positive. The file file contains clear, readable, well-commented JavaScript code that implements a UI manager for grouping tracker modules. All imports, functions, and DOM manipulations are proportionate to the stated project purpose of a modular RPG framework. No obfuscation, concealed execution, or malicious data flow is present in the supplied source.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- display-groups.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The code sets a starting web address for an AI model service, defaulting to one on your own computer. That's expected for programs that connect to local AI tools.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged line is a default value assignment for an Ollama URL in the extension's configuration defaults object, set to localhost:11434. Multiple similar defaults for local AI API endpoints appear throughout the file. These are standard defaults that users can override. No evidence of malicious external network targets or data exfiltration.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/state/defaults.js:134
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The flagged code uses a pre-filled local address for the Ollama AI service, which is typical for programs that run on your own computer. No hidden or dangerous behavior was found.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The scanner flagged a line containing a default localhost URL used as the default Ollama endpoint. This is standard configuration for local LLM backends and is not indicative of malicious or concealed behavior. The extension transparently uses user-provided API endpoints and keys to fetch model lists, which is expected functionality for an RPG framework that supports multiple AI providers.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- character-creation-connection.js:15
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This test file checks display group features. It is written in plain, readable JavaScript and contains no hidden code. The security scanner's warning is incorrect.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: Scanner flagged obfuscated-code on line 1, but the test file is a well-structured unit test with clear imports, functions, and test cases. There is no obfuscation, minification, or hidden logic. The scanner signal is a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- test
- Source
- tests/display-groups.test.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The security scanner noticed some web addresses (URLs) in this file, but they are just settings for which AI service to use (like Ollama or OpenAI). The extension needs these to talk to AI models, and they are saved locally on your device. No data is being sent anywhere secretly.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The JS-X-Ray 'shady-link' signal flagged URL strings within the profile save function, but these are configuration values for connecting to AI model providers (Ollama, OpenAI) deliberately exposed in the extension's settings. The file only persists settings to local storage via saveSettings; no network requests are made from this module. The flagged URLs are user-configured endpoints (defaults include localhost) necessary for the project's stated purpose of integrating external AI services.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/state/profiles.js:218
JavaScript analysis reported javascript.download-to-execution
Expected behavior · medium confidence
The extension connects to AI models over the internet, which is expected for this kind of RPG tool. There is no sign that it secretly runs downloaded code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner flagged a correlation between network retrieval and a code-execution sink, but the provided code shows only standard API calls via fetch (e.g., fetchOllamaModels) with JSON responses, no eval, Function, or dynamic code execution from network data. The extension communicates with LLM APIs as part of its stated RPG simulation purpose, and no dangerous data flow is demonstrated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- index.js:59-241
zizmor reported artipacked
Expected behavior · high confidence
This test workflow only runs the project's unit tests. It does not save any files or handle passwords, so there is no risk of credential leaks from this file.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked. The match applies to this repository.
Contextual assessment: The GitHub Actions workflow at file performs only checkout, setup-node, npm ci, and npm test. No artifacts step is defined, no secrets are referenced, and no credentials are persisted. The 'artipacked' signal from zizmor is a false positive because there is no artifact upload that could leak credentials.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- test
- Source
- .github/workflows/test.yml:11
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The extension sets up a default connection to a local AI model server on your own machine, which is expected for this type of tool. It doesn't send data to unknown external servers.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged line defines a default Ollama API endpoint for the project's AI wizard feature, defaulting to localhost:11434. This is a standard configuration for local model serving and is user-configurable. The code is transparent and serves the project's stated purpose of AI-assisted RPG system generation. No evidence of external exfiltration or malicious intent is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- game-systems.js:178
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
A security scanner flagged a web address in a test file. The address is just a placeholder used in a test to check that the settings function works correctly. No actual connection is made.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The static signal matches a literal URL string in a test file at line 53. The code is a unit-test call that passes an object with an ollamaUrl set to a test-only local address to a settings-mapping function. This test validates the shape of the output; it does not perform any network request. The URL is hardcoded test data with no runtime reachability beyond the test suite. No attacker-controlled input or data flow to an external destination is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- test
- Source
- tests/character-creation-connection.test.js:53
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · low confidence
A security scanner thought this file might contain hidden code, but it is actually just the game extension's editor interface. It uses normal JavaScript to create popups and settings panels. No harmful code was found.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The obfuscated-code signal was raised on file, a production file. The evidence shows standard JavaScript with ES modules, template literals, DOM manipulation, and normal function definitions. There is no minification, encoded strings, or concealed execution. The scanner likely flagged the large inline HTML strings inside template literals as potential obfuscation due to high density of special characters, but the code is purpose-built for UI generation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- ui-editors.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This file handles button clicks and user interface interactions for the RPG panel. The code is written in a normal, understandable way.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The file file is a standard SillyTavern extension UI module. It contains readable JavaScript with imports, event listeners, and DOM manipulation. No obfuscation patterns (encoded strings, minified variables, eval, or dynamic code generation) are present. The scanner signal is a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/ui/panel/card-events.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
The security scanner thought the code might be hidden or scrambled, but when we look at the actual file it is normal, easy-to-read code. There is no hidden or dangerous behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The static analysis scanner flagged this JavaScript file for possible obfuscation with low confidence. However, the complete source code provided in evidence shows clean, well-structured, and readable JavaScript with normal imports, exports, and function definitions. No obfuscated strings, encoded payloads, or concealed execution paths are present. The scanner signal is a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- portraits.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The extension uses a default address for a local AI service. This is normal and not a security risk.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The scanner flagged a literal string at line 505 as a shady link, but the only visible literal in that vicinity is the localhost default URL. This is a standard configuration value for connecting to a local Ollama instance, which is expected behavior for a SillyTavern extension that supports local LLM inference. No external or suspicious destination is involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- adventure-companion.js:505
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · low confidence
The code is written plainly and is easy to read. The alert about obfuscated code appears to be a mistake.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The obfuscated-code signal was raised with low confidence and the examined source code is clear, readable, and not obfuscated. No encoded strings, packed scripts, or concealment techniques were found. This is a false positive from the static analysis tool.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- index.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
A security scanner flagged a web address in a test file because it looks like a link. But the address is just an example used in a test to make sure the extension's settings work correctly. No real network call is involved.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The static signal fires on a literal URL string appearing in a test file at line 132. The code is a unit-test assertion that passes a plain object with an ollamaUrl property set to a hardcoded test value to a settings-mapping function. This test simulates how the extension would combine connection settings; it does not initiate any network request. No data flow to an external destination exists from this line. The scanner rule flags any URL as potentially shady, but the context confirms it is a benign test fixture.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- test
- Source
- tests/adventure-companion.test.js:132
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This file just stores lists of character sections (like 'Species', 'Body') in a clear, readable format. There is no hidden or scrambled code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The file file exports plain data arrays and a module name constant. The source is entirely human-readable JavaScript with JSDoc comments, no encoding, minification, string obfuscation, or suspicious transformations. The 'obfuscated-code' signal is a false positive; no actual obfuscation exists.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/state/schema-sections.js:1
JavaScript analysis reported javascript.download-to-execution
Expected behavior · medium confidence
The extension connects to AI services and responds to tool commands, but it does not run any risky code. The scanner warning is not a real concern.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner detected both network retrieval and a code execution sink in the same file, but the file does not contain any eval, Function constructor, or similar dynamic execution. The tool call handling uses structured function definitions for LLM tool calling, which is a standard pattern in SillyTavern extensions. Network requests are made to LLM APIs as expected. No actual code execution from untrusted input exists, so the correlation is a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- adventure-companion.js:14-700
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
A scanner thought this file might be hiding its code, but when you look at it, it's just normal code that creates the panel's user interface. Nothing is hidden or tricky.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner rule 'javascript.xray.obfuscated-code' flagged panel-markup.js at line 1 with high severity but low confidence. The actual file content is a well-documented JavaScript module exporting a buildPanelMarkup function that returns a template literal containing HTML markup. The code is not obfuscated; it is clean, readable, and follows standard patterns for generating UI strings. The scanner likely reacted to template literal complexity or string escaping, not actual obfuscation. No encrypted, minified, or concealed code is present. This is a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/ui/panel/panel-markup.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This extension talks to AI models you configure (like Ollama or OpenAI) to track your game state. The flagged line is just a normal part of reading the AI's response. No suspicious behavior was found.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged line (422) is part of a standard SSE streaming response parser that checks whether a line starts with 'data:'. The extension makes network requests to user-configured LLM endpoints (Ollama, OpenAI-compatible) as part of its core RPG state tracking and generation purpose. No evidence of unexpected or unauthorized network destinations was found.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- llm-client.js:422
JavaScript analysis reported javascript.xray.encoded-literal
Expected behavior · high confidence
A scanner thought a line of test code might contain encoded or hidden text, but it's just a simple test that checks if a function correctly handles a normal string like 'abc123'. There's nothing secret or dangerous.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal. The match applies to this repository.
Contextual assessment: The scanner flagged an 'encoded-literal' signal at line 21 in this test file. The literal at that line is the string `'abc123'` used in an assertion: `expect(sanitizeCampaignPrefixString('abc123')).toBe('abc123');`. This is a plain alphanumeric test string, not encoded or obfuscated. The signal is a false positive; no security concern exists.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.encoded-literal
- File role
- test
- Source
- tests/schema-helpers.test.js:21
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This file is written in plain, easy-to-read JavaScript with helpful comments. It just organizes how certain items are shown on screen. The 'obfuscated' warning is a mistake.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The file `file` is a clear, well-commented module that exports functions for normalizing and organizing display groups. The code contains no string literals suggestive of obfuscation; all variable names, comments, and logic are human-readable. The 'obfuscated-code' signal appears to be a false positive from the static analysis tool, with low confidence noted. No actual obfuscation, encoding, or concealment exists.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/features/display-groups.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The scanner found something that looks like a suspicious link or address, but the actual code shows this extension is supposed to connect to AI services as part of its roleplaying-game functions. There is no evidence it sends data anywhere bad.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The scanner signal 'shady-link' was triggered on line 1204 of panel-builder.js, but the matched literal values were not retained in the evidence. The surrounding code constructs aiSettings objects containing user-configured API keys and endpoints (openaiKey, ollamaUrl, openaiUrl) and passes them to a sendStateRequest function. This is expected functionality for an extension that makes AI requests; the extension's purpose includes AI-powered editing and NPC generation. No actual data exfiltration, concealed network access, or malicious destination is demonstrated by the provided code. The scanner_severity is low, consistent with a static pattern match rather than evidence of harmful behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/ui/panel/panel-builder.js:1204
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The code just sets a text field to a default web address that points to your own computer. That's normal for tools that let you run AI models locally.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged line sets a default value for an Ollama API URL to localhost:11434 within a UI settings sync function. This is standard configuration for local model services used by the extension. No external network destination or exfiltration is involved; the value is user-configurable. The JS-X-Ray signal is a false positive for a hardcoded localhost URL.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/features/chat/chat-state-loader.js:167
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This file builds the visual panel for the RPG tracker. The code is clear and easy to read, not hidden or scrambled.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The file file is a large but well-structured JavaScript module that builds the RPG tracker panel UI. It uses standard imports, DOM APIs, and event wiring. The code is fully readable with comments and no obfuscation techniques. The 'obfuscated-code' scanner signal is a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/ui/panel/panel-builder.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · medium confidence
A security scanner thought this file might have hidden code, but the actual code is a straightforward debug viewer for game messages. Nothing to worry about.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The JS-X-Ray static analyzer flagged this file as potentially containing obfuscated code, but examination of the actual source reveals standard, readable JavaScript with no encoding, string concealment, or malicious patterns. The file file implements a debug panel UI with local storage persistence and drag/resize interactions — all normal DOM manipulation. The signal is a false positive; no obfuscation exists.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- debug-viewer.js:1