The scanner flagged that the code does both network requests and some kind of execution. In reality, the network request sends audio to a transcription service, and the returned text is sent as a chat message. No downloaded code is ever executed.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlated a fetch call with a perceived execution sink. The fetch calls POST audio data to user-configured Whisper transcription endpoints (openrouter.ai, groq.com, or a custom local URL). The response is parsed via res.json() and only the transcribed text string (data.text or data.transcript) is passed to sendMessageAsUser and SillyTavern.getContext().generate(). There is no eval, Function constructor, innerHTML assignment, document.write, or any dynamic code execution from the network response. The response is used solely as text content. This is the expected data flow for a speech-to-text extension matching the stated project purpose.
The scanner flagged this code as potentially obfuscated, but the actual source is clean, readable JavaScript with clear variable names, comments, and straightforward logic. There is no hidden or obscured code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
API key handling is standard for SillyTavern extensions
low risk · high confidence
The extension stores the API key in the standard SillyTavern extension settings panel and sends it only to the configured transcription provider. This is normal and expected for a speech-to-text extension.
Technical assessment
The API key is stored in SillyTavern extensionSettings, entered by the user via a password-type input in the settings panel, and sent only as a Bearer token to the user-configured provider endpoint (OpenRouter, Groq, or a custom local URL). The key is not exfiltrated to any third party, not logged, and not embedded in URLs. This matches the stated project purpose of a multi-provider Whisper STT extension.
Network requests target only configured transcription APIs
low risk · high confidence
Audio recordings are sent only to the transcription provider the user selected, and the returned text is sent into the SillyTavern chat. This is exactly what a hands-free voice extension should do.
Technical assessment
The transcribeAndSend function sends recorded audio to the configured endpoint and receives a JSON transcription. The transcribed text is optionally quote-wrapped, then passed to sendMessageAsUser (imported from SillyTavern core) and generate is called to trigger the character response. No response data is used in any code-execution context. The data flow is proportional and disclosed in the README.