The only link in this HTML is the default local ComfyUI address shown as a placeholder in the settings text field. This is exactly what users expect to see for configuring their local ComfyUI connection.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
The flagged link is just the default local address for the user's own ComfyUI instance, which is exactly what this music-generating extension needs to talk to. No external or suspicious destination is involved.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
The extension fetches audio files from ComfyUI and uses SillyTavern's built-in file APIs to save, load, and delete them. This is normal behavior for a music library feature, not a download-and-execute pattern.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlated network retrieval primitives (fetch calls) with a code execution sink in the same representation. Examining the actual code at lines 256-270 and surrounding context: the fetch calls target SillyTavern's own API endpoints (/api/files/delete, /api/files/upload, /api/files/get) using getRequestHeaders(), and fetch to sourceUrl for retrieving generated audio blobs from ComfyUI. The deleteTrackFiles function deletes audio files when chats are removed. saveAudioToLibrary fetches audio from ComfyUI and uploads it to ST's file store. No eval(), Function constructor, child_process, or other dynamic code execution sink is present in the supplied evidence. The correlation is a false positive: the 'execution' is standard file I/O through ST's API, not code execution.
The code looks 'obfuscated' only because the HTML template is written as one long line. It is actually a normal settings panel with checkboxes, dropdowns, and text fields — just formatted compactly. There is no hidden or disguised code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged 'obfuscated-code' with low confidence on line 1. The artifact is an inline HTML template for the extension's settings panel, written as a single long line of markup. This is a common pattern for SillyTavern extensions that embed their UI HTML as a string. The content is standard HTML with form controls (checkboxes, selects, inputs, textareas) — no encoded strings, eval calls, character array manipulation, or other obfuscation techniques. The scanner signal is a false positive caused by the single-line formatting of the HTML template.
All network activity targets localhost ComfyUI or SillyTavern's own API
low risk · high confidence
All network calls go to the user's local ComfyUI or SillyTavern itself, which is the expected pattern for this extension.
Technical assessment
The getComfyUrl() function resolves the ComfyUI endpoint by checking user settings first, then falling back to localhost:8188. All fetch calls in the visible code target either this ComfyUI URL (for audio generation/retrieval) or SillyTavern's internal /api/files/* endpoints (for library persistence). No third-party or external destinations are present.
Inline HTML settings template is standard extension UI markup
low risk · high confidence
The flagged HTML is a straightforward settings panel for the extension, not obfuscated or malicious code.
Technical assessment
Both scanner signals on this HTML template are false positives. The 'shady-link' is the localhost ComfyUI placeholder, and the 'obfuscated-code' signal is triggered by the single-line inline HTML format. The template contains only standard form elements for configuring the extension (toggles, engine selectors, parameter inputs, workflow JSON textareas, and connection profile settings).