The extension loads its own settings panel template and lets users run Quick Replies from a QR tab. These are standard SillyTavern features done for legitimate reasons. There is no evidence of downloading remote code and executing it.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlates a network retrieval primitive with a code execution sink in the same file. The actual data flow shows no download-to-execution pattern. The retrieval is `ctx.renderExtensionTemplateAsync(__extPath, 'settings')`, which loads the extension's own local settings HTML template — a standard SillyTavern extension API. The execution sink is `executeCachedQuickReply`, which calls `qr.execute()` or `globalThis.executeQuickReplyByName()` to run Quick Replies when the user clicks them in the QR tab — a documented SillyTavern Quick Reply feature. These two capabilities are in separate code paths with no data flow connecting fetched content to execution. The `insertAdjacentHTML` call injects the rendered settings template, not dynamically fetched remote content. No `eval`, `Function`, `setTimeout(string)`, or similar dynamic code execution from network data is present in the supplied source. The extension's stated purpose (checkpoint/branch/swipe navigator with QR cache) is consistent with these capabilities.