The extension contacts a local ComfyUI image generation service (default address 127.0.0.1:8188) and constructs data URLs for image captioning. Both are expected for the extension's stated image visualization and captioning features, and the ComfyUI address is user-configurable.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
The extension loads SillyTavern's own built-in modules and calls SillyTavern's own translation API. This is normal behavior for a SillyTavern extension and does not download or execute any remote code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner flags a correlation between network retrieval and a code execution sink in lines 107-160. The actual code shows: (1) dynamic import() calls targeting SillyTavern's own local modules (extensions.js, script.js, translate/index.js) via relative paths, which is the standard ST extension pattern for accessing host APIs; (2) fetch() calls to ST's own same-origin API endpoints (/api/translate, /api/plugins/translate, /csrf-token) for translation functionality. No fetched network data is passed to eval(), new Function(), or any dynamic code execution sink. The import() calls load local ST framework modules, not remote code. There is no download-to-execution data flow present.
Translation endpoint probing uses ST's own API paths
low risk · high confidence
The extension calls SillyTavern's translation API and CSRF token endpoint, which is the expected way to use ST's built-in translation feature.
Technical assessment
The initTranslation function probes several same-origin ST API paths (/api/translate, /api/plugins/translate) to find the translation endpoint, then uses it for inline translation of responses. The makeHeaders function fetches a CSRF token from /csrf-token. Both are standard SillyTavern API interactions consistent with the README's stated translation feature.
The extension sends image generation requests to ComfyUI, whose address comes from user settings and defaults to the local machine. This matches the stated visualization feature.
Technical assessment
Detailed technical wording was omitted by the public report safety filter.