No material or immediate-danger concern was identified in this review.
This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.
0 immediate danger0 material4 low
What this review found
No material or immediate-danger item was identified.
Contextual expected matches (4)
Credential access and network transmission in one file
Expected behavior · high confidence
The flagged text is the project's technical manual, not running code. It explains that if you choose to use your own AI service, the extension sends your key only to the web address you typed in, which is how any custom-API tool must work. The manual also says the key is kept in your browser and kept out of places that would sync it elsewhere. Nothing shown sends your key or chats anywhere you did not choose yourself.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The flagged file is documentation, not executable code, so the scanner's co-location signal reflects described design rather than shipped behavior. The described data flow is the extension's disclosed custom-backend option: a key entered by the user is stored browser-side and attached as an authorization header only on requests to the OpenAI-compatible endpoint address the user themselves configured, alongside the analysis prompt built from recent chat messages. That destination matches the project's stated purpose of letting users power the analysis with their own API provider, and the documentation states the key is deliberately excluded from synced extension settings and chat metadata to avoid server-side persistence. The supplied evidence shows no hardcoded third-party destination, concealed channel, undisclosed recipient, or obfuscation; the only network destinations described are the user-configured endpoint and the host's own generation path. The implementation file was not part of this evidence group, so this assessment covers the documented design only, but nothing in it demonstrates credential exfiltration.
The extension does make network requests, but those go to an API endpoint the user themselves configures, which is exactly what the extension is supposed to do. The code-loading statements it uses point at SillyTavern's own local files, not at anything downloaded from the internet. There is no sign that code fetched over the network is run.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlates a network primitive with an execution sink in the same file, but the supplied source shows no download-to-execution data flow. The network activity consists of outbound requests to a user-configured OpenAI-compatible endpoint for the extension's stated analysis feature. The dynamic code-loading constructs (dynamic imports of SillyTavern's core script and its regex engine) use fixed relative host paths, not content retrieved over the network, and results are consumed as module objects rather than executed as fetched text. No eval, Function, or command sink operating on remote content is present in the supplied evidence.
Credential access and network transmission in one file
Expected behavior · high confidence
This is a documentation file that explains how the extension talks to the AI service, including the optional use of an API key. It is plain text with no code, so it cannot do anything on its own. The matching security keywords are just descriptions of the intended, visible feature.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The flagged file is a Markdown documentation schema with no executable content. It merely describes how prompts and an optional bearer token are transported to the user-selected backend. The keyword co-occurrence of credential and network terms in prose documentation does not constitute a code path, an attacker-controlled trigger, or any runtime behavior. No executable artifact is implicated by this evidence.
Credential access and network transmission in one file
Expected behavior · high confidence
The extension stores your API key and includes it when talking to the AI service you pointed it at, so the service knows the request is yours. That is the normal way API keys work. The key is only sent to the address you configured yourself, and there is no sign it is copied, logged, or sent anywhere else.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The file does read a stored API key and transmit it over the network, which is what triggered the scanner. However, the demonstrated data flow sends the key only as an Authorization header to the chat-completions and models endpoints derived from the base URL the user explicitly configured in extension settings, which is the documented custom-backend feature. The key is never logged, persisted elsewhere, or sent to any hardcoded or third-party destination. This is the standard, user-visible credential use pattern for an OpenAI-compatible client and is proportionate to the project's stated purpose.