No material or immediate-danger item was identified.
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:2414
Contextual expected matches (9)
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
A scanner flagged a line as containing a suspicious link, but the flagged text is just 'data:' which is part of the standard streaming response format used by AI APIs. The code parses streaming text from the LLM provider, which is exactly what a summarization extension should do. No suspicious external links are present.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The JS-X-Ray shady-link signal fired on line 316, which contains 'if (trimmed.startsWith(data:))' inside the parseSseStream function. The 'data:' prefix here is the standard Server-Sent Events (SSE) protocol line prefix used by OpenAI-compatible and other LLM streaming APIs, not a javascript:data: URI or suspicious external link. The function reads streaming response bodies, splits on newlines, and parses JSON payloads from SSE data lines. The full file contains only legitimate, well-known API endpoint references: the ST backend path /api/backends/chat-completions/generate and provider base URLs for OpenAI, Anthropic, and Google AI Studio. All network calls go through the ST backend. No external or suspicious destinations are present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/llm-utils.js:316
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is an Italian translation label for the 'Show/Hide key' button in the extension's settings. It does not contain any real password or secret — the scanner was misled by the word 'key'.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The gitleaks generic-api-key rule matched line 58 of the Italian language pack file. The actual content at line 58 is 'api.showHideKey = Mostra/Nascondi chiave', which is a UI translation string for a button that toggles API key visibility. No credential, secret token, or API key value is present anywhere in this localization file. The match is a false positive triggered by the presence of the word 'key' (chiave) in the translated label text. The file contains only human-readable translation strings and no executable code or secret material.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- language/it.lang:58
Gitleaks reported generic-api-key
Expected behavior · high confidence
A secret scanner flagged line 58 as containing an API key. The line is actually just a French translation of a button label that says 'Show/Hide the key'. There is no real secret here, just translated text.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Gitleaks matched a generic-api-key pattern on line 58 of the French language pack file. The actual line 58 content is 'api.showHideKey = Afficher/Masquer la clé', a UI localization string for a show/hide API key button label. The word 'clé' (French for 'key') combined with 'API' context likely triggered the generic pattern. No actual credential value is present; this is a translation file containing only display strings.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- language/fr.lang:58
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner flagged a line in an Italian translation file because it contains the words 'api' and 'Key' in a UI label. This is just translated text for a button that shows or hides an API key field, not an actual secret. No credential is present.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The gitleaks generic-api-key rule matched line 53 of the Italian language pack: 'api.showHideKey = Mostra/Nascondi chiave'. This is a localization string mapping the translation key 'api.showHideKey' to the Italian phrase for 'Show/Hide key'. The match is a false positive triggered by the combination of 'api' and 'Key' in the translation key name. No secret value, token, or credential is present anywhere in the file. The entire file consists of UI label translations for the SimpleSummary extension. There is no data flow, no execution, and no credential exposure.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- language/it.lang:53
Gitleaks reported generic-api-key
Expected behavior · high confidence
A secret-scanning tool flagged this line, but it is only a French translation of a UI label that says Show/Hide the key. No actual password or API key is present in this file.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Line 53 of file contains the translation string api.showHideKey = Afficher/Masquer la clé, which is a UI label for toggling API-key field visibility. This is a localization entry in a language pack file, not a credential. No actual secret value is present, and the file has no runtime execution scope that could transmit or use a key. The gitleaks match is a pattern false positive on the French word clé (key) in a translation context.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- language/fr.lang:53
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
A security scanner flagged this file as possibly containing obfuscated code, but the actual source is clearly written, well-commented JavaScript with descriptive names and standard patterns. There is no hidden or disguised code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The supplied source for file is readable, well-structured ES-module JavaScript with descriptive identifiers, comments, and standard DOM/storage/UI logic appropriate for a SillyTavern summarization extension. No string encoding, eval, hex obfuscation, packed arrays, or concealed execution are present in the provided evidence. The scanner's low-confidence obfuscation signal at line 1 is not corroborated by any obfuscated data flow or hidden behavior in the visible code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- index.js:1
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
A scanner flagged line 1 as potentially obfuscated code. Reviewing the actual code, line 1 is just a normal function definition with many parameters. There is no hidden or scrambled code. This is a false alarm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/prompt-presets.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
A scanner flagged a link-related pattern on this line, but the code is simply checking whether a character avatar path is a web address or local path so it can display the character's portrait correctly. This is normal and expected for an extension UI.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Line 2414 is inside getCurrentCharacterImageUrl, which reads the active character's avatar from SillyTavern context and resolves it to a displayable URL. The regex /^(https?:)?//i.test(avatar) distinguishes absolute URLs and data URIs from relative server paths so the correct image source can be used for the extension's portrait panel. No outbound network request, credential transmission, or data exfiltration is introduced by this URL resolution logic. The behavior is proportionate to the extension's stated purpose of displaying character information.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:2414
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
A scanner flagged this file as potentially obfuscated, but the code is clearly written and readable. It manages API configuration presets for a summarization extension, including storing API keys that the user enters. Handling API keys is expected behavior for this type of extension, and the keys are sent only to the SillyTavern backend, not to any third party.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- src/api-presets.js:1