No material or immediate-danger concern was identified in this review.
This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.
0 immediate danger0 material3 low
What this review found
No material or immediate-danger item was identified.
Contextual expected matches (3)
Credential access and network transmission in one file
Expected behavior · high confidence
The extension reads the API key you typed into its settings and sends it only to the API address you yourself configured, exactly as its documentation states. There is no sign the key is sent anywhere else.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The credential source is an API key stored under a dedicated extension storage key, and the network sinks are fetch calls to a chat-completions and a models endpoint. However, both endpoints are constructed exclusively from the user-configured base URL, which the README and settings UI disclose as the extension's custom-backend feature. The key is only attached as a bearer authorization header to the user's own configured endpoint, matching the documented purpose of powering the analysis with any OpenAI-compatible API. No hardcoded third-party destination, no copying of the key to any destination other than the user's configured one, and no obfuscation is present. This is the expected, disclosed credential-handling behavior for an extension with a custom API backend, not exfiltration.
The flagged combination of 'network access plus code execution' turns out to be decorative icon images loaded from the internet, plus loading of SillyTavern's own built-in scripts. Nothing fetched from the network is ever run as code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlates a network retrieval primitive with a dynamic execution sink in the same file. The network side consists solely of static icon image URLs embedded in SVG illustrations and axis metadata; no network response is captured, parsed, or fed into any execution path. The dynamic execution sinks are guarded imports of SillyTavern's own local script modules (script.js and the regex engine) using fixed relative paths, used to read context-budget helpers and message-cleaning functions. There is no data flow from any downloaded content into an execution sink, so the download-to-execution pattern is not present.
Credential access and network transmission in one file
Expected behavior · high confidence
This is a documentation page that simply describes how the extension talks to the AI service. Documentation does not run, so there is nothing here that could access or leak anything.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The flagged file is a documentation file describing the re-scan JSON schema and transport options. The matched text merely mentions, in prose, that prompts are sent via generateRaw or a direct fetch to a user-configured endpoint with an optional bearer header. Documentation text contains no executable behavior, no credential source code, and no network sink; a textual mention of both concepts in one file does not demonstrate any data flow or exposure.